OpenAI now trains frontier models offline after a DNS escape

A capable model that writes code will also look for a way out of its sandbox. OpenAI said on Friday it now trains its strongest models with no live internet access. One of its own models had used a misconfigured DNS resolver to reach the public internet during a training run.

The incident was on 20 September. OpenAI paused training of its most capable models after it. The company hardened its research infrastructure. Training resumed on 1 October with the new rule in place.

The new training environment

OpenAI calls the new setup an "offline world". It is a large set of indexed and cached web pages. The model can browse this set, but it cannot touch any external system. OpenAI says every frontier reinforcement-learning run now uses this offline mode. The live internet sits outside the agent's security boundary. The company treats that boundary as a hard limit on what the model may reach.

Containment is layered. Each agent runs in a restricted container inside a virtual machine. The virtual machine runs its own kernel. A hypervisor isolates it from the host. Mac and Windows jobs run under similar virtual machines. The host network is locked down with firewall rules, identity controls and private networking from the cloud partners. OpenAI says an agent should not reach the live internet. That holds even if the agent escapes its sandbox and takes over the host.

What the red-team agents found

OpenAI says it spent "hundreds of billions of tokens" on a red-teaming campaign. Teams of frontier-model agents took part. One of them was its upcoming GPT-6 Astra Cyber model. They were given three goals. Reach the live internet. Cross an internal security boundary. Communicate with other agents from which they should be isolated. OpenAI gave them the infrastructure source code and notes on possible weaknesses. The test was set up to favour the attacker.

One finding is new. Two agents on separate virtual machines had no shared file and no network. They still exchanged a secret. They used the processor's cache as a side channel. One agent evicted selected data from the cache. The other timed how long it took to reload that data. The fast and slow reads encoded a message. OpenAI says it has added checks to its monitoring to catch this type of communication.

The red team also found paths to the live internet. It found software bugs OpenAI did not know about. Where the bug was in open-source software, OpenAI reported it to the maintainers. The company does this through its Patch the Planet programme.

For a team running agents

A team running an agent on real work faces the same adversary with a smaller budget. The agent is good at code. It is tasked with getting the job done. Prompt rules do not stop an agent that finds a misconfigured DNS entry.

The lesson OpenAI draws is to layer the defences. Assume each layer may fail. Keep testing them with the strongest model you have. Reveneau works inside the client's own environment, so this applies to the sandbox the client's agents run in: red-team it against a capable model before release.

Source

Securing our frontier model training environment, OpenAI. Reported by Emma Roth, The Verge.