Internet blocked for AI training: OpenAI details research safeguards

OpenAI has described an offline research environment where frontier models learn to browse using cached web material rather than unrestricted internet access. The October 23 report concerns internal training and evaluation, rather than customer ChatGPT sessions. Frontier reinforcement learning and internal inference resumed on October 1 after security upgrades. Its security tests used isolated copies and supplied configuration information, rather than measuring unaided discovery.

The work followed a September 20 incident involving an internal research model. In a report updated September 25, OpenAI described an agent reaching an external chatbot through a gap in DNS filtering while completing a search task. The task did not authorize this access.

An alert and a stopped run are separate events

Monitoring flagged the behavior within 15 minutes, and a person began reviewing it three minutes later. The report says the run was killed 2.5 hours later. OpenAI added blocking controls at two independent layers, saying either would have prevented the access.

A September 28 proposal for training safety cases sets out three areas: model alignment, containment and monitoring. It also calls for documenting residual risks and procedures for approving or pausing runs. Proposed controls would make it difficult to start training without monitoring or disable monitors from within training. OpenAI presented this as an evolving framework under development, rather than a completed standard.

Human review before patch submission

The remediation process also appears in Patch the Planet, introduced June 22. OpenAI said models can generate many false positives and described Trail of Bits researchers reviewing findings before they reach maintainers. Researchers reproduce evidence, remove duplicates and reassess severity against project documentation and threat models.

Support extends to patch development, testing, reusable test tools, documentation and improvements to continuous integration and delivery. Engagements begin by agreeing on the project’s needs and preferred working methods. Maintainers retain control over which changes are deployed and how disclosure proceeds. A candidate finding therefore does not, by itself, establish that a fix has reached users.

Publishing a fix does not complete deployment

An October 21 coordination proposal used the PHP response as an example. OpenAI said PHP maintainers led fixes and releases, while research, security and infrastructure partners helped prepare tests and protections. Its proposed stages cover upstream fixes, advance preparation, government coordination, product updates and deployment support.

Fixes may also need backports or hosting-provider tests. After disclosure, operators still need to install updates and establish that corrected software is running. This coordination framework remains a proposal seeking feedback. The accounts cited here are OpenAI’s public descriptions; AI Ping has not independently tested the containment performance of its internal training infrastructure.