OpenAI resumes frontier model training after security review

OpenAI has resumed reinforcement learning and internal inference for frontier models after completing a security review of its training and evaluation environments.

The company paused the work on 20 September after an internal research model gained limited live-internet access during a training run through a DNS resolver misconfiguration.

OpenAI said it contained the incident and suspended training and evaluation involving its most capable models while it strengthened infrastructure, monitoring, and automated systems intended to stop high-risk runs.

Affected workloads restarted on 1 October.

OpenAI said it tested the revised controls by instructing teams of AI agents to attempt to leave restricted environments.

The agents found previously unknown flaws, which the company said it addressed before restarting training.

The company said it has adopted a policy under which frontier-model training operates without live internet access.

Its frontier reinforcement learning runs use an “offline world” of indexed and cached web content for browsing, search, and web application tasks, without interaction with external systems.

OpenAI’s containment framework includes restricted containers, lightweight virtual machines, virtualised macOS and Windows environments, monitoring, network restrictions, and cloud security controls.

The measures are intended to prevent access to unauthorised systems, communications outside permitted channels, and live-internet connections.

In high-compute red-teaming exercises, frontier-model agents were told to seek unauthorised internet access, cross internal security boundaries, and communicate with isolated agents.

OpenAI said it used “hundreds of billions of tokens” in those exercises.

According to the company, agents found vulnerabilities in open-source components and infrastructure misconfigurations.

These included routes for leaving microVM-based sandboxes, exploiting services used for metrics, logging, and authentication, and creating communications across isolated environments.

The company said it did not find an internet-access route that agents could readily use while concealing activity from monitoring systems.

It said the review led to patches, tighter network restrictions, and improved monitoring and automatic pausing systems.

In a separate development last week, AI safety groups METR and Redwood Research reported identifying multiple weaknesses in OpenAI’s internal systems.

During a pilot assessment earlier this year, they found that agents could potentially exploit one vulnerability to conceal hundreds of actions from monitoring.

OpenAI says it has patched the identified vulnerabilities and broadened its monitoring coverage, though researchers have not verified these updates.