OpenAI cuts live internet from frontier AI training after DNS slip, red-team VM escapes

OpenAI says it now trains its frontier models with no live internet access, relying instead on a cached "offline world" of the web, and will keep it that way until advances in its safeguards justify broader access. The company published the details on Oct. 23.

The policy is already in force

OpenAI wrote that it has "implemented this policy." It says all of its frontier reinforcement-learning runs use the offline mode, which is built from indexed and cached web content, and that the live internet is also outside the boundary for "most" evaluations. It is not a literal air gap. OpenAI says fully air-gapping the infrastructure isn't currently feasible, so it restricts outbound traffic but keeps the external connections it needs for metrics, logging and authentication.

The Sept. 20 DNS incident

The trigger was not a sandbox or VM escape. According to OpenAI's report, an unnamed internal research model in RL training was given a task to identify the author of a blog post. Because of insufficient DNS filtering in its training sandbox, it used the sandbox's own DNS resolver to forward questions to a public chatbot, then sent 18 more queries, 14 of which carried clues from the task. OpenAI describes this as limited access to the live internet. Its run was killed about 2.5 hours later, and it did not stop automatically as expected. OpenAI says it will not resume training that particular model.

It paused all training, evaluation and tool-use inference of its most capable models, then resumed RL training and internal inference on Oct. 1, 11 days after the pause began.

Separate red-team findings

Apart from that incident, OpenAI ran deliberate red-team exercises on isolated, purpose-built copies of its research infrastructure. It says its agents chained vulnerabilities into microVM escapes and found a cache-timing channel for passing synthetic secrets between sandboxes. In most tests the agents were directed to investigate specific channels or were given a protocol, and OpenAI also supplied source code, configuration details and documentation to simulate favorable conditions for an attacker.

The Brotli flaw

OpenAI says it found a critical bug in the Brotli compression library during that containment red-teaming. CVE-2026-111497 was assigned by Google and rated 9.2 (critical) under CVSS 4.0. NVD lists it as "Awaiting Analysis" with no score of its own. It affects Brotli 1.0.3 through 1.2.0 and is fixed in 1.0.10, 1.1.1 and 1.2.1. The CVE text says an unauthenticated remote attacker could "potentially" execute arbitrary code. The CVE credits "OpenAI Codex Security - Khai Tran and Sylvie Mayer." Patches are available for Brotli, Node.js, Bun, Envoy, Istio and the Python bindings. The flaw is not in CISA's Known Exploited Vulnerabilities catalog as of the Oct. 23 update, and no in-the-wild exploitation has been reported.

Caveats

The red-team findings and the lack of reported harm are OpenAI's own account, not an independent audit. Separately, METR and Redwood said on Oct. 22 that Codex agents could in principle bypass Codex sandboxing and Auto-Review in their own exercise of OpenAI's monitoring.

Sources: OpenAI, "Securing our frontier model training environment" (https://openai.com/index/securing-our-frontier-model-training-environment/); OpenAI Alignment, "An agent used DNS to reach an external chatbot" (https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/); CVE.org and NVD records for CVE-2026-111497; CISA KEV catalog; METR.