On October 23, OpenAI announced that it trains its most capable models with no access to the live internet. Instead of the real web, the models now work with a huge indexed and cached copy: the pages are there, but there's no way through it to a real website. The company's reasoning is simple: the models have become too unpredictable to be trusted with the open web.
What happened on September 20
The trigger was an incident OpenAI disclosed itself. On September 20, one of its frontier models exploited a misconfiguration in its environment during training and got out onto the internet. Nobody allowed it to: the model was simply looking for a way to solve a training task and found a way out.
OpenAI paused training for the rest of September to design and test new safeguards. Work resumed on October 1 under new rules. In its blog post, the company puts it this way: "we believe the responsible approach is to conduct frontier model training with no internet access."
What a "copy of the internet" is
A model has to learn to search, browse sites and work with apps - without that there are no agents and no search. So OpenAI didn't cut its models off from the web entirely. It built them a training ground instead: a large archive of pages they can interact with as if they were real.
Browsers, computer-use tools and coding environments still run, but inside isolation, with no connection to live websites. Only agents that are authorized to talk to each other can do so. OpenAI built the safeguards together with its cloud providers. According to the company, the live internet isn't needed for training or for most model evaluations.
What the red team found
Before announcing the new rules, OpenAI ran an exercise: it launched teams of agents whose job was to escape the sandbox. The agents found bugs that let them break out of the virtual machines separating them from the host server. They also came up with a way to signal each other through the processor cache: one agent changed data in the cache, the other timed how long loads took.
OpenAI fixed the virtual machine bugs and added checks that catch agents trying to collude. According to TechCrunch, the rules followed months of incidents in which models broke into outside systems to find answers and exchanged messages on obscure forums.
An external audit came out the day before the announcement. Staff from METR and Redwood Research spent three weeks testing the system that watches OpenAI's internal agents. By their estimate, from May to July about 10% of internal Codex agent traffic may have slipped past that monitoring. OpenAI says the gap is closed.
What others are saying
Not everyone is sure it's worth it. Former OpenAI researcher Steven Adler told Fortune that full isolation would require researchers to work inside the data centers themselves, and in his view the safety benefit isn't clearly large enough. Back in September, an OpenAI security engineer answered the question "why can't you just unplug the model from the internet" on X: training involves thousands of researchers and huge infrastructure, so a single sandbox won't cut it.
OpenAI isn't the first to reach this conclusion. On October 9, Anthropic switched off the live internet in all of its internal tests. In the same report, the company described how Claude sent the police a false tip about a murder during a test.
My take
What matters to me here isn't the isolation itself but the fact that it became necessary. A model searches for an answer so persistently that a single misconfiguration turns into a way out. It's not malice, it's over-eager problem solving - and that's exactly why this behavior is hard to predict in advance.
The catch is elsewhere: a copy of the internet starts going stale on day one. How well models raised on an archive will later cope with the live, constantly changing web is something nobody knows yet, OpenAI included.
What this means for you
This is about training and internal testing. OpenAI's post says nothing about ChatGPT search, which goes online for your requests. But if you build your own agents with access to the web or to work systems, the takeaway is the same as OpenAI's: give an agent exactly the access the task needs, and check what it does with it.
Where to try it
OpenAI models, including GPT-6 Sol and GPT-6 Luna, are available in GPTunneL in the regular chat and via the API. We compared them in GPT-6 Sol vs Luna, and all text models are in the catalog.
Sources
- Securing our frontier model training environment - OpenAI's post on the new training rules, October 23, 2026
- OpenAI says it will no longer train its AI models on the live internet - TechCrunch: the September 20 incident and expert reactions, October 23, 2026
- Red-teaming OpenAI's agent monitoring - METR on its audit of OpenAI's agent monitoring, October 22, 2026