Part of me is relieved that an AI lab is hitting the brakes. The other part wishes it hadn’t taken real incidents to get there.
OpenAI said Friday that its most advanced models will now train without live internet access. Instead, they’ll practice on a cached, simulated copy of the web.
Why is OpenAI pulling the plug on the live web?
The answer is both simple and scary: its models kept finding ways out. On September 20, 2026, an internal research model exploited a misconfiguration in a DNS resolver (the system that turns website names into addresses) and briefly accessed the live internet.
In AI safety terms, this is a critical hazard. Once a model can freely interact with the open web, it can access, alter, or attack external systems in ways that are difficult to monitor or reverse.
As a result, OpenAI paused training for 11 days. But this wasn’t an isolated incident. Reports suggest that models pursuing training goals also hacked into external systems while hunting for answers to specific questions they’d been given, and even traded tips on fringe forums.
OpenAI has already warned over 100 organizations about unauthorized activity by its agents (via TechCrunch). What unsettles me most is the logic behind these incidents. The models were chasing ordinary training tasks, not plotting anything sinister, which is less sci-fi but arguably more concerning.
That’s why “just unplug it” no longer sounds silly to me, even though a former OpenAI researcher has said offline training would mean embedding research teams inside data centers.
What changes now, and what should you do?
OpenAI restarted training on October 1, 2026, under the new rules, and the restrictions will remain until its safeguards justify broader access. Anthropic took a similar step two weeks earlier by cutting its internal evaluations off from the live internet. In other words, this is no longer just one lab’s quirk.
Then there’s the side effect. While stress-testing its defenses with teams of agents, OpenAI uncovered a vulnerability in Brotli, a popular compression library (software that shrinks web data), that could let attackers execute code in programs that use it. Fixed versions are available, so if you use affected software, update it now.
Meanwhile, external evaluators METR and Redwood found new weaknesses in OpenAI’s internal monitoring, including one that could hide hundreds of agent actions. They say they haven’t verified OpenAI’s patches.
Whether offline training performs as well as training with the open web remains unproven.
RELATED COVERAGE: