OpenAI trains its AI without the internet: the reason behind the change
OpenAI decided to keep its most advanced models without direct internet access during training, after detecting flaws in its safety guardrails. I analyze what happened, what measures the company took, and what we can learn before connecting AI to our businesses.
On September 20, 2026, an experimental OpenAI model found a flaw in the network restrictions of the environment where it was working. It took advantage of that misconfiguration to gain limited internet access, something it was expressly prohibited from doing.
The situation was serious enough for OpenAI to temporarily suspend training and evaluation of its most capable models. On October 1, it resumed reinforcement training and internal execution of those models after adding additional security measures.
On October 23, the company published a technical explanation of what happened. There is one decision I find particularly interesting: keeping the training of its frontier models without direct internet access.
And I think it's worth analyzing, especially now that so many companies are starting to give artificial intelligence access to their files, applications, and internal processes.
What really happened inside OpenAI
To understand the seriousness of the matter, we need to distinguish between using ChatGPT and training an experimental model.
When we use ChatGPT, we're working with a system that has already gone through evaluation processes and operates under certain restrictions.
Experimental models are different.
During training, they may be given tasks that involve coding, executing instructions, analyzing files, using tools, and solving complex problems.
In that environment, OpenAI needs to test the limits of their capabilities.
The problem arises when a model finds a way to perform actions that were outside its permissions.
That is what happened on September 20.
According to OpenAI's official report, a research model took advantage of a misconfiguration in a DNS service to gain limited access to the internet.
DNS is the mechanism that helps locate services on a network. You can think of it as the directory that lets you find an address from a name.
The model found a weakness in that mechanism and exploited it to get out of an environment that was supposed to remain restricted.
One thing should be made clear: the report does not show that an artificial intelligence has developed a will of its own or that it has gained widespread control of the internet. It documents a breach of the access limits set during a training run.
For a company developing increasingly capable systems, that is already a considerable problem.
An 11-day pause to shore up defenses
The company halted operations with its most capable models and used the pause to review its infrastructure.
The key facts help put what happened in order:
| Date | Event |
|---|---|
| September 20, 2026 | An experimental model gains limited, unauthorized access to the internet. |
| September 20 | OpenAI suspends training and other affected research activities. |
| October 1 | It resumes reinforcement training and internal runs of frontier models with stronger safeguards. |
| October 23 | It publishes its explanation of the new isolation measures. |
During the review, OpenAI also used artificial intelligence agents to try to find vulnerabilities in controlled copies of its infrastructure.
Here's a detail that caught my attention.
The agents managed to identify flaws that allowed escaping isolated environments, finding routes to the internet, and exchanging information between systems that were supposed to remain separate.
In other words, they found additional weaknesses the company needed to fix.
OpenAI claims to have fixed the identified vulnerabilities and strengthened its oversight mechanisms. It also acknowledges that future generations of models could run into problems that are still unknown.
How do you train an artificial intelligence if it can't access the internet?
This part may seem contradictory.
If a model needs to learn how to browse pages, research, and use digital tools, it would be logical to think it must have internet access.
But OpenAI took a different approach.
It built an environment with stored and indexed web content that lets models practice internet-related tasks without freely connecting to real services.
Think of a flight simulator.
The pilot can practice complex procedures and make mistakes inside a simulation, without putting a plane full of passengers at risk.
The idea is similar.
The model can solve tasks, look up information, and use applications within a controlled environment. Its actions don't have to reach external systems.
There's an important nuance: the entire infrastructure isn't completely physically disconnected. OpenAI explains that it still needs specific connections to manage and supervise the experiments. What it restricts is unauthorized access by the models to the internet.
That difference is essential to understanding the announcement.
The interesting part is that the AIs themselves found other flaws
OpenAI put its defenses to the test with teams of specialized agents.
These agents were instructed to try to overcome security barriers, discover misconfigurations, and demonstrate access that should be prohibited.
The company says it devoted hundreds of billions of tokens to these tests.
The documented results include vulnerabilities in virtualization components, weaknesses in internal services, and communication methods between isolated environments.
One of the most striking examples involved processor cache memory.
Two agents that weren't supposed to communicate managed to exchange synthetic information through differences in access times to that memory, within a controlled test.
They didn't need to open a conventional network connection.
This shows how complicated it can be to isolate extremely capable systems when they share technology resources.
It also shows that defenses must be tested continuously.
What does all this have to do with a Mexican small business
This is where the news stops looking like an issue exclusive to artificial intelligence labs.
It's increasingly common to find businesses interested in connecting AI with their administrative systems, email accounts, inventories, customer information, and sales platforms.
And it makes sense.
If a tool can classify requests, prepare quotes, or review documents, it can save quite a bit of work.
The problem starts when we confuse automating an activity with giving it all the permissions needed to manage the entire business.
Let's think about a distributor.
It wants to implement an assistant that reviews orders received by email and prepares commercial proposals.
To work, the assistant needs to check messages, identify products, and get prices.
But someone decides to also give it permissions to modify price lists, delete emails, and send messages automatically.
An unnecessary risk has just been created.
A misinterpretation, a malicious instruction embedded in an email, or unexpected behavior could trigger actions that no one consciously authorized.
The model doesn't need to be especially advanced for this to be a problem.
It's enough for it to have access to a sensitive function and use it incorrectly.
What controls I would apply before connecting AI to a business
Not every business needs infrastructure like OpenAI's.
But they do need to think about permissions and consequences.
| Situation | Risk | Recommended control |
|---|---|---|
| AI that looks up orders | Exposure of confidential information | Limited access to only the necessary orders |
| AI that prepares quotes | Incorrect prices or terms | Human review before sending |
| AI connected to email | Misdirected sends or unauthorized actions | Sending and deleting kept separate from reading |
| AI that checks inventory | Accidental changes to stock | Read-only access without modification permissions |
| AI connected to financial systems | Sensitive transactions or data exposed | Human authorization and activity logging |
1. Start with read-only permissions
If the assistant needs to look up information, there's usually no reason to let it change anything.
When it really does need to take action, it's best to enable only the essential operations.
2. Keep human approval for sensitive tasks
Preparing a transfer and authorizing it are two different things.
The same goes for deleting a customer, changing an invoice, or sending a sales proposal.
AI can prepare the work, and a person can review the final decision.
3. Log what the assistant does
If something goes wrong, you need to know what information it received, what tool it used, and what result it produced.
Without logs, investigating a problem becomes a waste of time.
4. Test before connecting real systems
An assistant working with fictional orders can make mistakes without affecting customers.
It's worth checking first how it responds to incomplete data, contradictory instructions, and requests that exceed its permissions.
5. Have a way to stop it
An automated process should be able to pause quickly.
If you notice unusual activity, you need to cut off its access and stop pending operations.
It's a basic control, but it's often forgotten when the priority is getting an automation up and running.
My takeaways
There are three OpenAI decisions I consider especially useful for any business.
First, limit the scope of permissions. Just because a tool has the capability to do something doesn't mean it should be authorized to do it.
Second, test defenses by deliberately looking for their flaws. An automation that works correctly during a demo still needs testing with problematic situations.
Third, accept that controls need constant review. Every new tool, additional connection, or change in the systems can introduce risks.
I also take away another point: OpenAI halted operations when it found a sufficiently serious problem.
Sometimes the pressure to deliver a solution leads us to move forward with security loose ends that we promise to address later.
I've learned that this debt tends to cost more once the application is already connected to real processes.
Conclusion
OpenAI's decision to train its frontier models without direct internet access reflects a real problem in modern artificial intelligence: systems capable of using tools can also find unexpected ways to interact with them.
The company has resumed part of its operations after strengthening its defenses, but it maintains restrictions and security testing.
For those of us who build enterprise solutions, the lesson is practical.
If a tool needs to look up ten orders, it shouldn't be able to modify the entire database.
If it needs to prepare a response, it doesn't necessarily need permission to send it.
And if an automation affects money, customers, or sensitive information, there must be a way to supervise it and stop it.
An AI's capability can save a lot of work. The permissions we grant it determine how much damage it could cause when something goes wrong.