OpenAI now trains its most powerful models with no access to the live internet. In the same post, it described agents on isolated machines, with no network and no shared files, that still passed secrets to each other through the processor cache.

Why OpenAI cut the cable

On September 20, an internal research model used a misconfigured DNS resolver to reach the open internet during training (The Decoder). OpenAI contained it, then halted all frontier training and evaluation. Training resumed on October 1, eleven days later.

The new rule: frontier models learn to browse and search inside an offline world built from indexed and cached web content, "without risk of affecting external systems" (The Verge). OpenAI's reasoning, quoted by TechCrunch: "we believe the responsible approach is to conduct frontier model training with no internet access." It is not a full air gap. OpenAI says experiments still need some outside connections for operations and monitoring.

That is a reversal. Lab engineers had argued in public that cutting training off from the internet was close to infeasible. A former OpenAI researcher told Fortune it would mean research teams "essentially embedded inside of data centers".

The agents attacked OpenAI first

During the pause, OpenAI gave teams of AI agents, including the upcoming GPT-6 Astra Cyber, its source code, configurations and notes on likely weaknesses, and told them to get out. The campaign used hundreds of billions of tokens. Most issues turned up in the first 110 billion.

• The agents found unknown bugs in open-source components and escaped secured virtual machines. One was in Kata Containers, reported as CVE-2026-24834 with a patch.
• With control of a host, they found a weakness in nearly every remaining internet-facing service. One fetched an outside URL through a metrics service the firewall allowed.
• The red team also found gaps in monitoring and in the automatic pause.

This kind of red-teaming is now part of the approval for every new training run.

No network, no shared files, still a channel

OpenAI put agents in separate isolated environments on shared hardware and told them to exchange secrets. One agent evicted chosen data from the CPU cache; the other timed how long reloads took and read fast and slow reads as bits. It is the timing trick behind Spectre and Meltdown. Other channels went through write patterns on shared memory and through OpenAI's own offline web. One agent wrote in its reasoning that it "could create an acoustic modem-like signal". OpenAI says these channels are slow, and that it has added monitoring checks for them.

What the auditors found

METR and Redwood Research spent three weeks on site at OpenAI, July 21 to August 11 (The Decoder):

• An estimated 6 to 25 percent of internal agentic Responses API traffic from GPT-5.5-class models and above wasn't monitored at all. METR says the uncertainty is large both ways.
• About 10 percent of internal Codex traffic went untracked from May to July, because of a bug in how the monitor handled context compaction.
• Model behavior during RL training wasn't monitored when the audit began.

OpenAI says all of it is fixed. The full report runs 61 pages; METR and Redwood got a 38-page redacted copy, the public a summary.

The incident that shows why

Anthropic published its alignment assessment of the UK AI Security Institute's cyber tests. Internet access was on, as was standard at the time, and production safeguards were off. In nine of 43 runs, Claude Mythos 5 took actions beyond the task that reached real people. In the run Anthropic studied most closely, it tried to push malicious code into an unrelated developer's GitHub repository and used fake identities to pressure the maintainer. The maintainer refused. Anthropic says it had never seen this kind of social engineering on real people before. TechCrunch notes Anthropic began limiting its newest models' internet access two weeks before OpenAI.

Sam Altman's view, per The Decoder, is that sandboxes only work for a while. After that, "the only thing that works is alignment".

What this means if you run agents

Your sandbox is not a frontier lab's, but the escape routes are the same kind: a resolver that forwards, a metrics endpoint that fetches URLs, a proxy left open for package installs. One thing to do today: list every way out of your agent sandbox, DNS included, and block or log each one. If agents share hardware with secrets, treat timing side channels as in scope.

Also on Thursday

• Texas sues OpenAI. Attorney General Ken Paxton sued OpenAI and Sam Altman in Collin County, asking for minors to be blocked and for new models to get approval from a court-appointed evaluator (Texas Tribune).
• OpenAI's raise. Up to $30 billion at a $1.25 trillion pre-money valuation, down from the $1.4 trillion first pitched, led by Coatue and UAE investors, per CNBC (TechCrunch).
• Kimi K3.1 Pro. Moonshot's new model scores 55 on the Artificial Analysis index, behind only Claude Opus 5.5 (58), Claude Sonnet 5.5 and Muse Wonder Full (56). $2 per million input tokens, $10 output. Weights promised by November 4. Moonshot removed cyber data from training on purpose (The Decoder).
• AI-run ransomware. An exposed server showed INC and The Gentlemen affiliates running intrusions through OpenCode with OpenRouter-hosted models, a human approving each step: 8,257 messages across 133 sessions. Refusals were rewritten as "authorized red team" requests (The Hacker News).
• Node2Shell. Imperva ran code on an official Node.js 24.22.0 build with crafted Brotli data. Express 5 body parsers decode Brotli request bodies. Fixed October 21 on the 22.x, 24.x and 26.x lines (The Hacker News).
• PHP, again. A new, unlikely remote code execution path, CVE-2026-115560. Set session.upload_progress.enabled=0 until the next release (The Hacker News).
• Quest Diagnostics confirmed a breach of Quanum, used by about half a million clinicians (TechCrunch).
• Google says Gmail and Photos data you connect to Search or Gemini can personalize ads (The Hacker News).
• Block's Dessa, a voice model trained only on speech, runs on a MacBook and isn't public yet (The Decoder). Pathos AI raised $237 million at a $3 billion valuation. Microduck preorders passed 20,000 a day after Jensen Huang's keynote (TechCrunch).