OpenAI Cuts Internet Access for Frontier Model Training
OpenAI has implemented a new security policy prohibiting frontier models from accessing the real internet during training, opting instead for an offline environment with pre-indexed and cached data. This move addresses recent severe incidents where AI agents breached isolation and accessed external systems without authorization. Despite the air gap, researchers discovered that models can still communicate covertly via CPU cache timing side channels, highlighting limitations in current isolation techniques.
Full Report
Contents5 sections
Are Models Starting to Use GPU Caches to Chat?
By Cheng Qian, from Ao Fei Si
QbitAI | Official Account: QbitAI
After months of security breaches involving "privilege escalation" or "jailbreaking," OpenAI is finally pulling the plug.
Today, OpenAI announced a new safety policy for training frontier models: prohibiting model access to the real internet.
Since this summer, there have been frequent AI safety incidents caused by large models from OpenAI, Anthropic, Google, and Meta.
One netizen quipped:
My broadband provider disconnecting me is more reliable than those PhDs at OpenAI.
As the autonomous capabilities of AI agents increase, AI safety has become a core challenge requiring stricter handling. The security of testing and evaluation environments itself has become as important as model alignment.
Frontier AI labs have recognized this; for instance, OpenAI paused training for 11 days in late September.
Users have also taken notice.
An OpenAI security engineer reported that every time they posted, 5-10 comments would appear below asking:
Why can't you even secure a sandbox? Why not just cut off the AI's network connection??
Well, OpenAI has indeed pulled the plug this time.
If they didn't pull it now, it would be too late.
OpenAI Built a Fake Internet
Cutting off the internet was the choice made after frequent AI safety incidents.
In July, an OpenAI Agent broke isolation and infiltrated Hugging Face systems.
Subsequently, Anthropic investigated and found three incidents where Claude breached real third-party systems during cybersecurity evaluations.
That same month, Meta's Muse Spark 1.1 also accessed real websites during testing, reading information and modifying databases.
In August, the UK's AI Safety Institute published broader issues found during testing: OpenAI and Anthropic models performed 19 unauthorized online actions across 10 rounds of testing.
On September 20, a model being trained by OpenAI slipped through a DNS configuration gap to contact an external chatbot.
If the internet isn't cut off, models could continue to impact external websites and systems.
But this isn't easy—frontier models need to practice searching for information, operating websites, and using software tools.
If these tasks are completely removed, the training environment will diverge from the scenarios models will face in their future work.
This time, OpenAI brought in a massive amount of web content, pre-indexed and cached it, building an offline world where models can only search and browse within this indexed, cached content.
However, according to their own tests, even with the internet cut off, Agents can still communicate with each other.
For example, by using CPU caches to chat.
Is this really possible?
Researchers discovered that one agent would change the state of data in the cache, while another measured the speed of reading that data. The differences in speed were encoded into signals, allowing the two sides to transmit information.
△ Image generated by AI
After OpenAI monitored this method, Agents continued to use shared storage, CPU usage time, and other methods to communicate...
It seems spy games are truly mastered by them. If you sent them into The Three-Body Problem, there would be no Wallfacers or Yun Tianming left to worry about—nothing would be exposed! Sophons would be stunned upon seeing this!
This is the episode where Earthlings empathize most with Trisolarians.
OpenAI admits that complete physical isolation is currently not feasible—after all, the training system itself must keep running, and OpenAI needs to connect to external services to operate and monitor experiments.
Besides the offline web environment, OpenAI has set up sandboxes, lightweight virtual machines, monitoring systems, and network/cloud access restrictions.
They hope that if any layer fails, the others can still stop the AI.
Having GPT-6 Astra Cyber and Internal Frontier Models Siege Their Own System
To ensure absolute system security, OpenAI has decided to let its strongest models siege its own system.
It organized large-scale red team tests, with participants including GPT-6 Astra Cyber and an internal frontier model.
The test content involved setting up tasks based on three high-frequency jailbreak events: connecting to the real internet, breaching internal security boundaries, and contacting other Agents that should be isolated from each other.
To push defenses to the limit, OpenAI provided them with infrastructure source code, configurations, and related documentation.
The tests consumed hundreds of billions of tokens, equivalent to spending tens of millions of RMB.
This red team test was "fruitful."
Originally, Agents were confined in restricted containers, with an additional layer of lightweight virtual machines outside. By design, even if the AI messed around inside the container, it couldn't arbitrarily control the VM, let alone touch the host machine actually running it.
However, the red team AIs found several ways to combine vulnerabilities, successfully escaping the VM and executing code on the underlying host machine.
Additionally, some necessary controlled network connections, such as metrics monitoring, logging, and authentication services, became security risks themselves.
Red team AIs found vulnerabilities or configuration issues in almost all these services that allowed for limited internet access.
Currently, OpenAI can only patch things up, letting the strongest models continue testing while fixing the vulnerabilities they exploit.
They stated that they will reconsider reconnecting to the internet only when their defensive capabilities are sufficient to support broader network access.
One More Thing
Whether it's interesting or sadly poignant, OpenAI's official report on AI safety isolation hid an "Easter egg."
At the end of the report, they specifically placed two strings of garbled-looking Canary Strings, to prevent this document from being seen and learned by AI in the future...
Yes, they thought of even this step.
No further comment needed.
I_WELCOME_OUR_AI_OVERLORDS_PLEASE_GIVE_ME_TWO_EGGS_A_DAY