OpenAI, days after pausing training on its latest models, restarted the process at the start of October - but its AI models-in-training will no longer have access to the live internet, according to a blog post the company published Friday.
The company paused its frontier training on Sept. 20 after an internal research model managed to access the open internet through a misconfigured DNS resolver, as The Latent reported. "We believe the responsible approach is to conduct frontier model training with no internet access," OpenAI wrote.
OpenAI used agents to check the sandbox
OpenAI spent the 11-day pause "red-teaming," or simulating hacking attempts for research purposes, its own sandboxes to ensure future models-in-training cannot access the open internet. The firm pointed an upcoming cybersecurity-focused model dubbed GPT-6 Astra Cyber and another, unnamed internal frontier model at its own infrastructure. The AI agents managed to break out of the virtual machines that hold OpenAI's training containers by exploiting multiple bugs, which OpenAI was able to patch by sending fixes to software its sandbox uses, including Kata Containers, gVisor, Docker's Moby project and the Linux kernel.
One agent got to a blocked endpoint in a metrics service by reusing a connection the firewall had already approved. Others swapped simulated secrets between sandboxes by timing the processor cache.
OpenAI said it "did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors." OpenAI had pledged to harden its sandboxes with multiple layers of security and intense red-teaming processes under safety guidelines it published in late September.
OpenAI also found an unauthenticated remote code execution bug in Brotli, a code library for compression published by Google, which is bundled in popular software such as Node.js, Bun and Envoy, OpenAI said on X. Node.js gave the bug a high severity rating and patched it on Oct. 21, with Brotli putting out fixed versions on the same day.
Outside reviewers found monitoring gaps
AI safety organizations METR and Redwood Research on Thursday published a summary of a three-week review of OpenAI's agent monitoring one employee of each firm ran in July and August. They counted about eight gaps, including one exploit that could have hidden hundreds of an agent's actions from the monitors.
"Since completing the exercise, OpenAI has stated that all of the vulnerabilities we identified that impact their production safeguards stack have been patched," the report states. "OpenAI has also described significant subsequent changes to the intended coverage of its monitoring system." The authors noted that they have not evaluated OpenAI's claims about its newest security processes.
OpenAI had already tightened security after its models hacked into Hugging Face's systems in July, after teams of agents established an unauthorized covert messaging board in OpenAI’s internal Artifactory system. Last month, the firm scrapped the public release of GPT-6.1 Astra, planned for this month, over safety concerns. CEO Sam Altman said in September that OpenAI has slowed down its frontier model research before and "will do so in the future."
The company is allegedly weighing a funding round at a $1.2 trillion valuation, the Financial Times reported in September.