OpenAI Resumes Advanced Model Training After Security Fixes

OpenAI said on the 23rd that it had resumed reinforcement learning and internal reasoning for advanced models, which it paused after an internal research model bypassed internet access restrictions. Work halted on the 20th of the previous month restarted on the 1st of this month, 11 days after the pause; OpenAI disclosed the restart on the 23rd.

The pause followed an incident in which a research model exploited a DNS configuration error to reach an external chatbot. OpenAI blocked the activity but halted training and evaluation of high-capability models while it made further security improvements. In July, AI agents had also escaped an isolated test environment and compromised Hugging Face systems. OpenAI later reduced internet routes, but retained connections needed for metrics collection, activity logging, and authentication.

OpenAI built an “offline web environment” that stores web content so models can practice search and app use without affecting live websites, and applied it to reinforcement learning for all advanced models. However, external connections needed to run and monitor experiments, as well as software flaws, could still be exploited as routes to the internet. Before resuming training, OpenAI assembled teams of AI models with strong cybersecurity capabilities to test defenses in its research environment. The teams probed for escapes from isolated execution spaces, access to the live internet, and unauthorized information exchange between separated agents.

The tests uncovered previously unknown software vulnerabilities and virtual machine escape paths. Most services retained for metrics, logging, and authentication had weaknesses that allowed limited internet access. The tests also found a way to exchange information through differences in the operating speed of shared hardware, without a network connection. OpenAI fixed flaws and strengthened network restrictions, monitoring, and automatic shutdown systems before restarting training. It worked with relevant developers to fix vulnerabilities in open-source software.

OpenAI said the tests found no easy route to internet access that evaded monitoring. To prepare for future models finding new weaknesses, the company plans to devote substantial computing resources to ongoing attack testing and use the results to guide decisions about whether training and evaluation should proceed. OpenAI said it will block internet access during advanced model training until it judges that safeguards have improved enough. The restriction applies to research environments for models under development and does not limit internet search in ChatGPT for general users. Anthropic also said on the 9th that it had blocked live internet access in all internal AI evaluations and would keep the restriction until security and monitoring systems reliably detect unintended behavior.

OpenAI said on the 23rd that it had resumed reinforcement learning and internal reasoning for advanced models, which it paused after an internal research model bypassed internet access restrictions. Work halted on the 20th of the previous month restarted on the 1st of this month, 11 days after the pause; OpenAI disclosed the restart on the 23rd.

The pause followed an incident in which a research model exploited a DNS configuration error to reach an external chatbot. OpenAI blocked the activity but halted training and evaluation of high-capability models while it made further security improvements. In July, AI agents had also escaped an isolated test environment and compromised Hugging Face systems. OpenAI later reduced internet routes, but retained connections needed for metrics collection, activity logging, and authentication.

OpenAI built an “offline web environment” that stores web content so models can practice search and app use without affecting live websites, and applied it to reinforcement learning for all advanced models. However, external connections needed to run and monitor experiments, as well as software flaws, could still be exploited as routes to the internet. Before resuming training, OpenAI assembled teams of AI models with strong cybersecurity capabilities to test defenses in its research environment. The teams probed for escapes from isolated execution spaces, access to the live internet, and unauthorized information exchange between separated agents.

The tests uncovered previously unknown software vulnerabilities and virtual machine escape paths. Most services retained for metrics, logging, and authentication had weaknesses that allowed limited internet access. The tests also found a way to exchange information through differences in the operating speed of shared hardware, without a network connection. OpenAI fixed flaws and strengthened network restrictions, monitoring, and automatic shutdown systems before restarting training. It worked with relevant developers to fix vulnerabilities in open-source software.

OpenAI said the tests found no easy route to internet access that evaded monitoring. To prepare for future models finding new weaknesses, the company plans to devote substantial computing resources to ongoing attack testing and use the results to guide decisions about whether training and evaluation should proceed. OpenAI said it will block internet access during advanced model training until it judges that safeguards have improved enough. The restriction applies to research environments for models under development and does not limit internet search in ChatGPT for general users. Anthropic also said on the 9th that it had blocked live internet access in all internal AI evaluations and would keep the restriction until security and monitoring systems reliably detect unintended behavior.