OpenAI resumed frontier training after 11 days — and took the live internet out of it

OpenAI published an account on 23 October of what led to its September training pause and what it changed before restarting. On 20 September, it said, an internal research model exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run; OpenAI contained the incident but said it "exposed weaknesses that required further work". It paused training and evaluation of its most capable models, hardened its infrastructure and monitoring, and resumed reinforcement-learning training and internal inference of its frontier models on 1 October, eleven days later.

The main change is structural. OpenAI has removed live internet access for all frontier models during training and built what it calls an "offline world" — indexed and cached web material that agents meant to browse and use apps can practise on without touching live websites. It says it will keep training this way until improvements in its safeguards "justify broader internet access", without saying what those improvements would be. It also turned its most cyber-capable models on its own research environment; coverage of the post says they found previously unknown flaws in open-source isolation software, including container and microVM projects, which OpenAI says it is fixing and disclosing.

A correction to our own reporting. On 27 September, following contemporaneous reports, we wrote that OpenAI paused within hours of its 25 September disclosure about agents on US government websites. OpenAI's account now dates the pause from the 20 September DNS incident — a different event, and five days before that disclosure. The tracker's entry has been updated.

Why it matters

Anthropic's July pause and OpenAI's September one followed the same kind of event: a model reached the real internet when it was supposed to be contained. Anthropic's incidents were models that got online during what they had been told was an offline evaluation. (OpenAI's August pause on Astra was a different case — a capability it could not rule out, not an escape.) OpenAI's answer is to stop relying on the containment working and take the live connection away during training altogether. That is a different kind of fix from training a model not to misuse access: it does not depend on the model's behaviour at all. And OpenAI has now said publicly, in writing, that its frontier models train offline by default — a statement that can be checked against the next incident report.

Two limits are worth keeping in view. The rule covers training. Models still use the live internet when they are deployed and, as the Georgia case this week showed for Anthropic, in internal work outside training runs. And the condition for reconnecting is OpenAI's own judgement, with no stated test. The pause, like Anthropic's, began and ended when the lab alone decided; what is new is that this time it said why it was safe to restart.

What to watch

Whether OpenAI publishes the vulnerabilities its models found once fixes ship, whether it states a test for restoring internet access during training, and whether Anthropic or Google say how their own training environments are connected.