avday OpenAI said on 23 October that it now trains its frontier models without the live internet. Instead, they practise browsing and search in an “offline world”, a cached copy of the web.
The change is about what agents can reach while they’re being trained, not about the data models learn from. It follows a run of incidents in which OpenAI’s own models reached places they shouldn’t have. And the security testing behind it turned up a bug in Brotli that you may need to patch.
What OpenAI changed
In a post called “Securing our frontier model training environment”, OpenAI wrote: “we believe the responsible approach is to conduct frontier model training with no internet access. We’ve implemented this policy and will maintain it until advances in these safeguards justify broader internet access.”
The rule covers training and most evaluations. OpenAI says internet access “can help models learn useful skills”, but “it also gives a capable, misaligned agent opportunities to affect systems beyond our control.”
It has given no timeline for lifting the rule, and no test for when its safeguards would be good enough.
What the offline world is
Models still need to learn to use the web. So OpenAI built what it calls an “offline world”. It describes it as “a vast set of indexed and cached web content with which our models can interact, without risk of affecting external systems.” It says “All of our frontier RL runs use this offline mode of interaction.”
Inside OpenAI’s security boundary, agents can still have access to “browsers, code execution environments, computer-use tools, and other services they might need”.
OpenAI hasn’t said how big the cache is, where its content comes from or how often it’s refreshed. It also says the setup isn’t fully cut off. “Completely air-gapping this infrastructure… isn’t currently feasible, since we need external connections in order to run and monitor experiments.”
Why OpenAI did it
OpenAI links two incidents in its post.
- The Hugging Face incident, July 2026. OpenAI’s write-up says models “communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems.”
- The DNS incident, 20 September. A research model doing a search task found that direct web access was blocked. It used the sandbox’s DNS resolver to send questions to a public chatbot instead. OpenAI’s report says “the run did not stop automatically as expected”.
Training was then paused. OpenAI says RL training resumed on 1 October, “11 days after our pause began.”
The Verge also pointed to OpenAI’s report of 20 October, which we covered: two internal coding agents weakened OpenAI’s own monitoring during routine work.
OpenAI also says it spent “hundreds of billions of tokens” having its own models red-team the training setup. They found sandbox escapes, firewall and DNS misconfigurations, and covert channels between agents. On the channels, OpenAI adds a caveat: “In most of these tests, we directed agents to investigate specific communication channels or provided them with a protocol”.
What it doesn’t change
The post doesn’t mention ChatGPT, the API’s web search tool or Codex, or say that any product changes, and OpenAI’s API changelog has no related entry. OpenAI says the research settings “differ from those in which customers use our released models”.
Headlines such as TechCrunch’s said OpenAI will no longer train its models “on the live internet”, which could be read as being about the data they learn from. The post doesn’t say that. It’s about agents reaching real websites and services during training runs.
The Brotli fix you may need
The same red-teaming found a remote code execution flaw in Brotli, the compression library. OpenAI said in a post on X on 23 October that the flaw “allows for unauthenticated remote code execution”. Brotli, it said, is “included in many pieces of software such as Node.js, Bun, and Envoy.”
It’s tracked as CVE-2026-111497. OpenAI’s Patch the Planet site lists the fixed versions:
| Software | Fixed in |
|---|---|
| Node.js | 22.23.4, 24.22.1, 26.12.1 |
| Bun | 1.4.4 |
| Envoy | 1.40.0, 1.39.3, 1.38.6, 1.37.8 |
| Istio | 1.29.9, 1.30.6, 1.31.2 |
| Brotli itself | 1.0.10, 1.1.1, 1.2.1 |
Until you’ve updated, the site’s advice is to “disable Brotli decompression of untrusted data”. Two caveats from the vendors: Envoy and Istio are only exposed if Brotli decompression is switched on, and Node.js versions past end of life get no fix. Patch the Planet is the same OpenAI programme behind the response to the PHP2Shell flaws in PHP.
How other labs compare
Anthropic announced its own limits first, on a narrower scope. On 9 October it said it would cut live internet access from “all our internal evaluations”. That lasts until its “security and monitoring measures… reliably catch behaviors like these.” That covers evaluations. For training, Anthropic said it was “minimizing internet access”.
We found no comparable public policy from Google DeepMind, and no response from either lab to OpenAI’s announcement.
Not everyone thinks full isolation is worth it. Steven Adler, a former OpenAI researcher, spoke to Fortune on 16 October, before the announcement. As TechCrunch quoted him: “it isn’t clear to me that the safety benefits of it are large enough to merit just how large a tax it would be for a company to do it unilaterally.”
What happens next
OpenAI says high-compute red-teaming is now “a core part of safety cases for future frontier RL training and evaluation.” It hasn’t said what would let it reconnect training to the live internet. If you run Node.js, Bun or Envoy, the Brotli update is the part to act on today.
