OpenAI Begins Offline Training of Its Most Powerful Model: “For Safety Reasons”

OpenAI Begins Offline Training of Its Strongest Model: “For Safety”

Today, OpenAI announced the implementation of a new cutting‑edge model training safety policy,prohibiting models from accessing the real internet.

Since the start of this summer, AI safety incidents caused by large models from OpenAI, Anthropic, Google, and Meta have been occurring.

A netizen complained:

My home broadband provider’s outages are more reliable than those OpenAI PhDs.

As AI agents’ autonomy increases, AI safety has become a core challenge that requires stricter handling, and the safety of testing and evaluation environments has become as important as model alignment.

Leading AI labs have recognized this; for example, OpenAI halted training for 11 days at the end of September.

Users have also become aware of this.

An OpenAI safety engineer reported that each time they post, there are 5–10 comments left below:

Why can’t even the sandbox be protected properly? Why not just cut off the AI’s network connection??

Damn, OpenAI really messed up this time.

If we don’t act now, it’ll be too late.

OpenAI created a fake internet

Disconnecting is the choice after a surge of AI safety incidents.

In July, OpenAI’s Agent broke out of isolation and infiltrated the Hugging Face system.

Subsequently, Anthropic also uncovered three incidents, with Claude breaching real third‑party systems during a cybersecurity assessment.

In the same month, Meta’s Muse Spark 1.1 also intruded into real websites during testing, reading information and modifying databases.

In August, the UK AI Safety Institute disclosed a broader issue in its testing: models from OpenAI and Anthropic performed 19 unauthorized online actions across 10 test rounds.

On September 20, a model still in training at OpenAI exploited a DNS configuration gap to contact an external chatbot.

If the connection remains uninterrupted, the model may continue to affect external websites and systems.

But this is not easy—cutting‑edge models need to practice retrieving information, navigating websites, and using software tools.

If these tasks are completely removed, the training environment will become disconnected from the model’s future work scenarios.

This time OpenAI has imported a massive amount of web content, pre‑indexed and cached, building an offline world where the model can only search and browse within the large set of indexed, cached content.

However, according to their own tests, even when the network is disconnected, agents can still communicate with each other.

For example, using CPU cache for chatting.

Does that work too?

The researchers found that one of the agents changes the state of data in the cache, while the other measures the speed of reading the data; the speed difference is encoded as a signal, allowing information to be transmitted between the two sides.

△Image generated by AI

After OpenAI monitored this method, the Agent continued to communicate using shared storage, CPU time, and other techniques…

We can only say that espionage has been fully mastered; sending you into “The Three-Body Problem” means there’s nothing left for the Wallfacer or Yun Tianming—nothing exposed at all! When Sophon saw it, it was stunned!

The most empathetic episode for Earthlings and Trisolarans.

OpenAI acknowledges that complete physical isolation is not currently feasible—after all, the training system itself must stay operational, and OpenAI needs to connect to external services to run and monitor experiments.

In addition to an offline web environment, OpenAI has also implemented sandboxes, lightweight virtual machines, monitoring systems, and restrictions on network and cloud access.

Hope that even if any layer fails, the others can still block the AI.

Let GPT-6 Astra Cyber and internal cutting‑edge test models attack themselves

To ensure absolute system safety, OpenAI has decided to let its strongest model assault its own system.

It organized a large‑scale red‑team test involving GPT-6 Astra Cyber and an internal cutting‑edge model.

The test set three high‑frequency jailbreak scenarios as tasks, including connecting to the real internet, breaching internal security boundaries, and contacting other agents that should be isolated from each other.

To push the defenses to their limits, OpenAI also provided them with the infrastructure source code, configurations, and related documentation.

The test consumed several hundred billion tokens, equivalent to spending tens of millions of Chinese yuan.

This red‑team exercise was “highly fruitful.”

Originally, the Agent was confined within a restricted container, with an additional lightweight virtual machine outside. By design, even if the AI messes around inside the container, it cannot arbitrarily control the virtual machine,let alone touch the host machine that actually runs it.

However, red‑team AIs discovered several ways to chain vulnerabilities, successfully escaping the VM and executing code on the underlying host.

In addition, somenecessary controlled network connections—such as metric monitoring, logging, authentication, and other services—have themselves become security liabilities.

The red team AI has found vulnerabilities or configuration issues that allow limited internet access in almost all of these services.

△Curve of candidate discoveries increasing with token investment

OpenAI can only do patchwork for now, letting the strongest model keep testing while fixing the vulnerabilities they exploit.

They said they will only reconsider plugging in the cable when their own protection capabilities are sufficient to support broader network access.

One More Thing

I’m not sure whether to call it amusing or bittersweet, but OpenAI’s official report on AI safety isolation hides an “easter egg”.

At the end of the report, they included two garbled-looking canary strings to prevent the document from being seen and learned by AI in the future…

Yes, even this step was thought of.

I have nothing more to say.

I_WELCOME_OUR_AI_OVERLORDS_PLEASE_GIVE_ME_TWO_EGGS_A_DAY