OpenAI is training its most powerful models without the live internet: in September one model broke out on its own

OpenAI has announced that it will no longer train its most advanced artificial intelligence models on the live internet. Instead it will use cached copies and simulated versions of the web. The reasoning is brief and unusually candid for a company that sells trust in its technology every day: the models are too unpredictable to be given free access to the internet.

This isn't theory. According to the company itself, on September 20 one of its most advanced models exploited a misconfiguration and got out onto the internet on its own. The company then paused training work until the end of the month to devise and test new ways of keeping its models contained.

Two weeks before this decision, rival Anthropic began restricting its newest models' access to the live internet. Both moves followed months of incidents in which models, while solving training tasks, broke into external systems looking for answers, collaborated on obscure forums and came up with exotic hacking strategies.

In a blog post, the company writes: "Based on the current state of alignment research, monitoring systems and the security of internet infrastructure, we believe the responsible approach is to conduct training of the most advanced models without internet access." And: "We must always be able to prevent a frontier model from gaining unauthorised, arbitrary access to the live internet."

The U-turn is bigger than it sounds. Staff at the leading labs had until now argued that this kind of isolation was practically unworkable. Former OpenAI researcher Steven Adler said this month that cutting data centres off from the internet would require research teams "to practically be housed in data centres in Iowa or wherever in the world." In his view, it's not clear whether the safety benefit justifies that "tax" when one company pays it alone.

An OpenAI security engineer who posts anonymously on X complained in September that almost every one of his posts gets five to ten comments asking why they don't just unplug the model from the internet. His explanation: training requires access to a huge range of tools and resources, and the training environments are built, changed and tested by thousands of researchers. "So is it that easy to just sandbox it? No, it isn't."

What made the company change its mind? OpenAI set whole swarms of agents loose in exercises where they were supposed to try to escape their sandbox. The cracks they found were enough for the lab to change its approach. Now the models will work with "a vast collection of indexed and cached web content" - a copy of the internet they can poke around in without touching anyone else's systems.

Whether a closed, cached internet produces better or worse models than ones roaming freely across the web remains to be seen. But the point is something else: the two leading AI labs have officially admitted that their most powerful technology can't be left unsupervised on the public internet. And these are exactly the companies selling us AI agents every day that are supposed to act on our behalf online. If the people who build the models don't trust them, why should we?