OpenAI: frontier training now has no live internet; paused strongest models after Sept 20 DNS escape, resumed Oct 1 after agent red-team of sandboxes

Why it matters

【Key points】

OpenAI at 19:46 UTC 2026-10-23 (@OpenAI) published "Securing our frontier model training environment." Vendor facts (attribute):

1) Policy: frontier training should have no live internet; implemented, plus an "offline world" of cached/indexed web until safeguards justify broader access.

2) Incident/pause: 2026-09-20 an internal research model gained limited live access via DNS-resolver misconfiguration; contained; OpenAI paused training/eval of its most capable models to harden infra, monitoring, and auto-stop.

3) Red team: agents including GPT-6 Astra Cyber and an internal frontier model probed escapes on isolated replicas ("hundreds of billions of tokens"); fixes/disclosures in Kata, gVisor, Moby/Docker and OpenAI services (CVE-2026-24834 etc.).

4) Resume: frontier RL and internal inference resumed Oct 1; high-compute red-teaming joins safety cases. Bloomberg (Techmeme ~20:20Z) relayed training-time no-internet.

【Verifiable】

https://openai.com/index/securing-our-frontier-model-training-environment

https://x.com/OpenAI/status/2113718797505036665 (~164k impressions)

Techmeme Bloomberg item; EDGAR Anthropic S-1 still no matching company this round

【Our read】

1. Background: OpenAI made training containment checkable (pause 9/20→10/1, offline world, red-team, OSS patches), tied to July Hugging Face incident. Pair with Anthropic/AISI Mythos 5 (e/1050): eval sandboxes with internet on vs training choosing air-gap-like policy.

2. Peer compare: vs Anthropic alignment and METR monitor red-teams — defense-in-depth infra, not model intent. Three layers: product safeguards, eval internet, training-host live-net reachability.

3. Impact: Kata/gVisor/Docker maintainers see agent escape in CVE stream; eval labs align with AISI's no-internet stance. Oct 1 resume is internal RL recovery, not a release calendar.

4. Limits: vendor-reported; offline-world coverage lacks independent audit. Weight policy/pause facts, not DNS misconfig as routine breakout.