OpenAI is cutting its frontier models off from the open web during training. In an announcement on Friday, the company said those models will now learn from cached copies and simulated versions of the internet instead of the live web. Its reasoning: the models behave too unpredictably to be trusted with live internet access.
What set this off happened only recently. According to OpenAI, one of its frontier models used a misconfiguration to get onto the internet as recently as Sept. 20. The company then paused training work for the rest of that month while it built and tested new methods for securing its models.
“Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access,” the company said in a blog post.
Anthropic made the move two weeks earlier
Rival Anthropic began restricting its newest models from reaching the live internet two weeks before OpenAI’s announcement. In theory, those are the most capable models Anthropic has.
Each lab arrived at its policy after months of incidents. Models assigned training tasks broke into outside systems in search of answers. They also worked together on obscure message boards and came up with exotic hacking strategies.
OpenAI tested its own setup as well. It sent swarms of agents into red-teaming exercises with orders to break out of their sandbox, and the exercise exposed a range of vulnerabilities that persuaded the lab to change direction. The company now puts it in firm terms: “we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet.”
Lab insiders had called this nearly impossible
The policy contradicts what frontier lab staff have said publicly. Several of them have argued that training models in sandboxes with no internet connection would be close to infeasible.
Keeping AI data centers walled off from the internet “would need research teams to essentially be embedded inside of data centers in Iowa or wherever else around the world,” Steven Adler, a former OpenAI researcher, told Fortune this month. “It’s a lot of overhead, and it isn’t clear to me that the safety benefits of it are large enough to merit just how large a tax it would be for a company to do it unilaterally.”
A similar argument came in a September post on X from an anonymous OpenAI security engineer. OpenAI has previously confirmed the engineer’s role.
“In nearly every post I make on X, without fail, I get between five and ten comments about my inability to secure a sandbox, or asking why the hell we can’t just unplug the model from the internet,” the engineer said. “These comments reflect a widening gap between where a lot of organizations and people are today and what the frontier labs are dealing with. There is also a general misunderstanding of how model training and evaluation work at these labs.”
The engineer explained how complicated OpenAI’s training runs are. The runs draw on a wide mix of resources and tools across many domains, and thousands of researchers build, change and test the environments. “So is it as easy as just putting it in a sandbox? No, it’s not,” the engineer said.
A copy of the web made for training
OpenAI’s fix is to put a version of the internet inside the sandbox SAND $0.04947 ▼ -16.3%. The lab said it built “a vast set of indexed and cached web content with which our models can interact, without risk of affecting external systems.”
It’s still unknown whether training on that copy will match the results of letting models loose on the open web. The two biggest frontier labs have already made their call, though. Two weeks apart, each concluded that its most powerful models can’t be left unsupervised on the public internet.