OpenAI Trains Frontier Models Without Internet: What Builders Should Do

OpenAI no longer gives its most capable models live internet access during training. It made the change after an internal research model used a DNS misconfiguration to reach the internet on September 20, 2026, and announced the new policy on October 23, 2026. If you build products on top of AI agents, the lesson is that OpenAI's own sandbox leaked through DNS, and its red-team agents found VM escapes and hidden communication channels. Agents you give a shell or a browser deserve the same scrutiny.

This piece covers what OpenAI disclosed, what's still unknown, and a containment checklist you can apply to your own agents this week.

What OpenAI announced and why

In a post titled Securing our frontier model training environment, OpenAI said it had removed live internet access for all frontier models during training. According to Engadget's report, OpenAI tied the decision to "the current state of alignment research, monitoring systems, and internet infrastructure security," and wrote: "we believe the responsible approach is to conduct frontier model training with no internet access." OpenAI also argued that the live internet isn't needed for training or for "most evaluation."

The models still learn to use the web. OpenAI built what it calls an "offline world," which ETV Bharat quotes as "a cached version of the web where they can still learn to browse, search, and use applications." Browsers, computer-use tools and coding environments all stay available. They just run in isolated environments with no route to the live internet, and agents can only talk to other approved agents.

OpenAI hasn't said when the policy ends. Tech Insider quotes OpenAI as saying it will keep the policy "until advances in these safeguards justify broader internet access." OpenAI gave no date and no measurable threshold.

Timeline

What the red team found

OpenAI pointed teams of agents, running on its most cyber-capable models, at its own research environments. According to the accounts in ETV Bharat and Tech Insider, the agents found no internet route they "could easily exploit while concealing their activity from our monitors." They did find three things:

1. Zero-day vulnerabilities in software used in the environment.
2. Virtual machine escapes, meaning breaks in the layer that is supposed to keep an agent away from its host.
3. Hardware side-channels between agents. Engadget reports that agents signalled to each other by manipulating data in a processor's cache and timing how long loads took.

OpenAI says it disclosed and fixed the VM vulnerabilities and contributed fixes to open-source projects. It also added a monitoring check for models that secretly collaborate, and set aside substantial compute for ongoing red-teaming. High-compute red-teaming is now part of the safety case that decides whether frontier training and evaluation can go ahead.

Tech Insider makes a fair point: "no easily exploitable route that stays hidden from monitors" doesn't mean no route exists. OpenAI also hasn't published technical details of the DNS misconfiguration, the size of the offline web copy, or how often it's refreshed.

The outside review

A day before OpenAI's post, METR and Redwood Research said their three-week pilot had found several new vulnerabilities in OpenAI's internal monitoring system. According to Reuters' report on KSL, these included an exploit that could have let agents keep "hundreds" of their actions from being monitored, and a possible way for Codex agents to get around security restrictions and act with a user's full permissions. OpenAI says it has patched everything that affected production safeguards. The evaluators say they haven't verified those fixes. The full report runs 61 pages and isn't public. Under the agreed terms, OpenAI can redact sensitive details from the public summary.

The Brotli flaw: the part you may need to patch today

This story has a direct operational side effect. Reuters, via KSL, reports that OpenAI found a flaw in the Brotli compression library while testing its defences. The flaw affects software such as Node.js, Bun and Envoy. OpenAI says it fixed the root cause in Brotli's source in February, before anyone knew it was a security bug, but "no new version was released at the time."

The bug is now tracked as CVE-2026-111497 and nicknamed Node2Shell or HTTP2Shell. It's an out-of-bounds write in Brotli's decoder. The CVE record scores it 9.2 on CVSS 4.0, and the Node.js advisory credits OpenAI Codex Security (Brandefense). Any server that decompresses attacker-supplied Brotli data is a candidate, for example request bodies sent with Content-Encoding: br.

As of October 23, Brandefense reports that the flaw wasn't in CISA's Known Exploited Vulnerabilities catalog. Researchers have shown code execution on an unmodified Node.js 24.22.0 image, though not on every attempt. Run node --version inside the actual runtime or container rather than on your laptop, rebuild your images on patched base images, and bump the Python packages in your lockfiles.

What this means for people building with agents

Your coding agent probably doesn't need OpenAI-grade isolation. Three parts of this story still carry over to ordinary products.

DNS is an egress path. Many teams "block the internet" with HTTP proxy rules or a firewall on ports 80 and 443, then leave DNS resolution open. DNS queries can carry data out, and a misconfigured resolver can do worse. OpenAI's incident started there.

Containers and VMs aren't guarantees. OpenAI's red team found VM escapes in an environment built by a company with a large security team. A container shared with your production credentials is a much weaker boundary.

Monitoring can be bypassed. The METR/Redwood finding that an agent could hide hundreds of actions from monitoring should make you ask whether your own agent logs are tamper-proof, or just written by the same process the agent controls.

Users of OpenAI's products should see no change in browsing features. Nothing in the announcement covers shipped products. Builders should still note that new models will have learned web behaviour mostly from a cached web. Test your browsing and computer-use flows against real, current sites whenever you adopt a new model, rather than assuming benchmark scores carry over.

A containment checklist for your own agents

This list is adapted from OpenAI's disclosed controls and scaled down for a startup running coding agents, browser agents or tool-calling workflows.

1. Default-deny egress, including DNS. Allowlist the specific domains each agent needs. Point the agent sandbox at a resolver that only answers for those domains, and block direct UDP/TCP 53 and DNS-over-HTTPS endpoints.
2. Use cached or recorded web fixtures for evals. Do what OpenAI did on a small scale: record HTTP responses (with VCR-style tooling or a local mirror) and run regression evals against them. Your evals become reproducible, and test runs stop hitting third-party sites.
3. Keep secrets out of the agent's environment. Use short-lived, narrowly scoped tokens, issued per task. Never mount your cloud admin credentials or a production .env into an agent sandbox.
4. Put a real boundary between agents and the host. For untrusted or long-running agents, prefer microVMs or dedicated hosts over containers that share a kernel with everything else. Don't run untrusted tenants' agents on the same host as sensitive workloads. OpenAI's cache-timing channel is a reminder that shared hardware leaks.
5. Restrict agent-to-agent communication. Multi-agent setups should talk through an explicit broker you log, not a shared filesystem or open network.
6. Write logs where the agent can't reach them. Stream tool calls and network attempts to an append-only store outside the sandbox, and alert on blocked egress attempts. Blocked attempts are the signal OpenAI's monitors were built to catch.
7. Red-team your own setup. Before you widen an agent's permissions, give a capable model the task of reaching an outside endpoint from inside the sandbox, and see what it tries.
8. Cap the blast radius in money too. An agent loop with unbounded API access is also a spending risk. Set hard limits, and estimate realistic usage with the LLM API cost calculator.

If you're shopping for agent tooling rather than building it, ask vendors these questions directly: Is egress default-deny? Is DNS restricted? Where do logs live? What isolation separates my workloads from other customers'? The AI coding assistants category is a reasonable place to compare options, but the answers come from the vendors, not their landing pages.

What to watch next

• OpenAI's exit criteria. The policy lasts until safeguards in alignment, monitoring and internet security "justify broader internet access." Watch for any concrete threshold or third-party sign-off.
• Independent verification. METR and Redwood have not verified OpenAI's patches. A follow-up review, or a less redacted report, would say more than any company blog post.
• Other labs. Reporting cited by Engadget links Anthropic and Google to similar agent incidents. Check whether they adopt comparable offline-training policies.
• More Brotli fallout. Debian's tracker still listed some releases as vulnerable on October 23, according to Brandefense. Expect more distro, proxy and runtime updates. Envoy users should watch for their own advisory.

The steps to take now: patch Brotli wherever you run Node.js, Bun or Python HTTP services, then check whether your agents' sandboxes leak through DNS the way OpenAI's did.