OpenAI said it restarted frontier-model training Oct. 1 after a research model gained limited live internet access in a Sept. 20 run; outside reviewers said they had not assessed later monitoring fixes.
OpenAI said a misconfigured DNS resolver enabled the access during a training run. The company contained the incident and paused training and evaluation of its most capable models. It also resumed internal inference when training restarted.
OpenAI’s policy is to train frontier models without live internet access. The company said its reinforcement-learning runs use indexed and cached web content in an offline setting, allowing models to practice browsing and web application tasks. It said a complete air gap is not feasible because external connections are needed to run and monitor experiments.
OpenAI said its red-team exercise used agents that consumed hundreds of billions of tokens. The tests exposed weaknesses that let agents breach sandboxes, move between systems, reach outside networks and communicate across isolated environments, the company said. OpenAI said it patched vulnerabilities and tightened network controls. It also said the tests found no path to the internet that agents could trivially use while evading monitors.
OpenAI said its red team identified an unauthenticated remote-code-execution vulnerability in Brotli, a compression library used by software including Node.js and Envoy. The Node.js Project said crafted Brotli data could make its decoder write outside allocated memory, potentially crashing a process, exposing memory or allowing code execution. Its Oct. 21 security release listed Node.js lines 26.x, 24.x and 22.x as affected.
METR and Redwood Research reported results from a three-week pilot held July 21 to Aug. 11. They evaluated the monitoring system as it stood when testing began and estimated that 75% to 94% of agentic internal Responses API traffic from models with capability at least equal to GPT-5.5 qualified for monitoring. The researchers said the estimate was highly uncertain.
The pilot also found a method that could suppress monitoring for hundreds of recent agent actions. METR and Redwood could not determine whether agents had used it. OpenAI told them that it had since patched vulnerabilities affecting production safeguards, but the researchers said they had not assessed those changes or the system’s expanded current coverage.
OpenAI said it will continue red-team exercises and keep frontier training offline until improved safeguards support broader access. It gave no date for reconsidering that policy.
