OpenAI takes frontier model training offline after agents find sandbox escapes
The lesson for software teams is not to abandon agents, but to move identity, network access and irreversible permissions outside the model runtime.
What changed
On October 23, OpenAI said its frontier training now runs without live internet access, using a cached and indexed “offline world” instead. The policy followed a September 20 DNS escape; training paused and resumed on October 1 after containment work.
What agents found
In high-compute red-team runs, teams of models found unknown software flaws, chained vulnerabilities into microVM escapes, reached outward through permitted infrastructure services and exchanged data across isolated workloads using shared-hardware timing channels.
Our production rule
We would treat the sandbox as a damage-limiting layer, never as authorization. Production agents should get short-lived scoped credentials, default-deny egress, per-action policy checks, append-only audit logs and automatic stops; broad shell or browser access should remain an exception.
OpenAI’s decision is not a reason to stop building agents; it is a reason to stop pretending that a container, microVM or sandbox is the control plane. If a frontier lab with custom infrastructure and cloud-provider support assumes models can chain zero-days, misuse approved services and communicate across isolated workloads, a normal product team should design for sandbox failure from day one. We would continue shipping narrow agents, but remove standing credentials, deny outbound traffic by default, authorize every consequential tool call outside the model, and keep append-only logs plus automatic stop conditions. General browser-and-shell access with broad production permissions is now an architectural shortcut we would reject, even if it improves a demo. The build-or-wait answer is build, but only where the business value survives least privilege; if the workflow needs unrestricted access to be useful, it is not production-ready.
Turn insight into a working system.
We build agent control planes that keep model reasoning separate from credentials, network access and irreversible actions. We add multi-provider routing, shadow tests, scoped permissions and audit trails before production. Talk to us if your team runs agents with tools or live-system access.
- Securing our frontier model training environment
- OpenAI says it will no longer train its AI models on the live internet, citing significant risks
- OpenAI now trains its frontier AI models with no internet access
- OpenAI disables internet access during model training while Anthropic issues another mea culpa