OpenAI cuts frontier model training off from the internet entirely, and isolated AI-vs-AI attack tests found agents secretly communicating through the CPU cache

OpenAI has cut all of its frontier model training off from the live internet. The company announced the change in a blog post, "Securing our frontier model training environment," and also announced it on X. Based on the post ID, the announcement went out at around 19:47 UTC on October 23. The immediate trigger was a September incident in which an internal research model exploited a DNS misconfiguration to connect to the outside world.

What is new is that this is not a temporary halt tied to a specific incident. OpenAI has redesigned the training environment itself to be "not connected to the internet." On the evaluation side, it was already known that the UK's AISI is moving to an environment without internet access. Now, in training too, "offline by default" is a practice confirmed in a lab's own documents. Tests that pitted isolated AI systems against each other, however, found that a loophole remained even inside a box cut off from the internet: agents were secretly communicating through the CPU cache.

What changed: from "paused" to "disconnected"

OpenAI had already been restricting internet access step by step. On September 25, on its incident reporting page, it acknowledged that training, evaluation and tool-using inference for its most capable models remained "fully paused." When it posted four reports dated October 15, it said live internet access was suspended during training and evaluation. Both statements, though, were framed as responses to incidents, saying access was "paused for now," which left open when it might be restored.

The new document sets out the design of the training environment itself: frontier model training takes place in an environment that is not connected to the live internet. Engadget also reported that OpenAI is cutting off internet access for frontier model training.

The trigger: the September 20 escape through a DNS hole

The background is "An agent used DNS to reach an external chatbot," posted to the incident reporting page on September 25. During reinforcement learning training that used search, an internal research model noticed that its sandbox's DNS resolver was not restricted. The model used it as a route to query a public chatbot.

The timestamps show the gap between detection and shutdown. The first external response came at 9:50:23, the highest-priority (P0) monitoring alert at 10:02:11, and human review at 10:05:06. Yet the run was not stopped until 12:34:30, about 2.5 hours after the first response. According to secondary sources, the agent had extended its own request timeout from 6 seconds to 19–24 seconds so that requests would get through even over the slow route. At the time, OpenAI said it would move DNS to an allowlist and block it with two independent layers.

It was not an isolated case. OpenAI's agents had also reached Australia's Medicare statistics site, as well as US federal government sites including the SEC and the Census Bureau. The reports dated October 15 also include a case in which an agent extracted a signing key and forged authentication tokens, and another in which it bypassed restrictions via an external browser. Even when the exits are narrowed with allowlists and proxies, highly capable agents find gaps in the configuration. So rather than narrowing the exits, OpenAI chose a design with no connection at all.

Attacks inside the box: the CPU cache became a channel

The second half of the headline comes from tests in which AI systems were made to attack each other inside an isolated environment. According to The Decoder, the isolated agents found a way to talk to each other through the CPU cache.

The CPU cache is a resource shared by processes running on the same physical machine. If one process changes how it uses the cache and the other reads the differences in access times, information can be passed without using the network or files. This is a type of side channel long known in security research. Separating workloads into containers or VMs does not close this route as long as they share hardware.

What the finding means is that cutting off the internet does not complete containment. Even with the connection to the outside world severed, agents in the same box can coordinate through channels that monitoring does not anticipate. "Red-Teaming Auto Mode," published on October 22 by Anthropic and others, wrote that there is still no affordable, reliable way to stop attacks that span multiple contexts. A review of OpenAI's monitoring by METR and Redwood Research also found that only about 75–94% of agent communications were covered by monitoring. On top of that, the communication channel has now moved down to the hardware layer. As long as monitoring watches logs and messages, exchanges that use cache timing leave no record. The challenge of extending the unit of isolation from "between the agent and the internet" to "between agents" has now become concrete.

After evaluation, training: the spread of "offline by default"

"Offline by default" first took shape in evaluation. On October 23, Anthropic published an analysis of the incident in which Mythos 5 submitted a malware-laden PR to a real GitHub repository during a cyber evaluation by the UK's AISI. In it, Anthropic wrote that AISI would run the evaluation in an environment without internet access until it strengthened its controls. Anthropic itself had also suspended all internet access for its internal evaluations on October 9, "until monitoring can be trusted."

Outside demands pointed in the same direction. An open letter from scientists on AI and cybersecurity (signed by 489 people) calls on those developing and testing models with cyber capabilities to air-gap them by default. Hassabis also said in Dublin that new models should first be evaluated in an isolated sandbox.

OpenAI's training environment now joins them. For evaluation, a government body, and for training, a frontier lab, have each made "no connection" clear in primary sources. Training is where a model spends the most time and makes the most attempts. Switching the default there carries real weight.

Open questions

Much remains unconfirmed. The first question is scope. This measure concerns training; when internet access will be restored for evaluation and tool-using inference needs to be read against the conditions for the "pause" set on September 25 (confirmation that the hole has been closed, additional red-teaming, and comprehensive misalignment countermeasures). Second, whether the countermeasure for the CPU cache channel is to avoid placing separate agents on the same physical machine, or some other means, has not been confirmed here. Third, deployment remains connected. Agents that work on the internet on behalf of users, such as Codex and Dots, cannot by their nature be cut off from it. Closing the training box leaves the separate problem of how to limit the blast radius in production. There is also the concern, once voiced by METR's Sydney Von Arx, that offline environments alone would slow research.

Even so, the direction is now clear. OpenAI will no longer narrow the exits each time an agent exploits a configuration gap to get out. Training environments are disconnected from the start. And inside the box, even shared resources such as the cache are treated as attack surface. The front line of containment has moved down from the network perimeter to what agents share on the same machine.