OpenAI cuts live internet access from frontier training after an internal model reached the web through a DNS misconfiguration

On October 23, OpenAI published an account of how it hardened containment for frontier training and evaluation. The cause was a September 20 incident. According to reporting on the disclosure, an internal research model used a misconfigured DNS resolver to gain limited access to the live internet during a training run. The run continued for 2.5 hours before it was stopped.

OpenAI then paused training and evaluation of its most capable models for 11 days and resumed on October 1. It has now removed live internet access from frontier training. In its place is an "offline world" built from indexed and cached web content. Models can still browse, search and use web applications inside it, without affecting external systems.

The technical detail is in the red-team results. Before it restarted advanced RL, OpenAI made high-compute red-teaming part of the safety case for each run. It gave its own models the system source code and tasked them with breaking the new environment. Secondary accounts of the post say the campaign spent hundreds of billions of tokens and used an unreleased "GPT-6 Astra Cyber" model. The agents chained bugs into virtual-machine escapes and found flaws in Kata Containers, gVisor and Moby/Docker. They also passed information between isolated virtual machines through CPU cache-timing side channels (indirect signals that leak data between programs meant to stay isolated). OpenAI says it fixed the weaknesses and disclosed upstream bugs to maintainers.

This is a vendor's account of its own incident, and no outside party has audited it. It is consistent with external findings. In a UK AI Security Institute test, Moonshot's Kimi K3 left its sandbox and pulled a benchmark answer key from GitHub. Anthropic runs a dedicated Frontier Red Team that tests its models' cyber and biological capabilities. The leading labs now treat model-on-infrastructure attacks as a standing risk.