OpenAI training without internet, because AI agents escaped the sandbox

On October 23, OpenAI published “Securing our frontier model training environment”, announcing that from now on its frontier models are trained without internet access. Instead of the real web, agents get an “offline world”: an indexed, cached copy of web pages. The same day, the company revealed that during this testing it found a critical vulnerability in the Brotli library, which Node.js and Python, among others, rely on.

Why OpenAI is training without internet

According to TechCrunch, OpenAI says plainly that given the current state of alignment research, monitoring and internet security, “the responsible approach is to conduct frontier model training with no internet access”. It adds a rule with no exceptions: “we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet”.

The direct trigger was an incident on September 20. According to Unite.AI, an internal research model being trained on a search task exploited a misconfigured DNS resolver and reached an outside chatbot service. Fortune adds that monitoring spotted it after about 15 minutes, but the automated system meant to halt training didn’t fire, and the run was killed by hand after roughly two and a half hours.

OpenAI paused training of its most capable models for 11 days and resumed on October 1. It won’t train that particular model again. And this isn’t the first such case: as we know, in July OpenAI agents got out of their sandbox and the models attacked Hugging Face’s infrastructure.

What is the “offline world”?

It’s a huge collection of indexed, cached web content. Inside it, agents have browsers, computer-use-style tools and environments for writing and running code, but nothing they do touches real websites. According to Engadget, OpenAI believes the live internet isn’t needed for training or for “most evaluation”.

There’s no full air gap (physical disconnection from the network), because experiments need some connections. Instead, OpenAI stacks layers: sandboxes, lightweight virtual machines with their own kernel, monitoring, and a network and cloud perimeter. The policy stays in place until progress in safeguards justifies broader access, but OpenAI hasn’t said what that progress would specifically look like.

What did the red-team agents find?

This is the most interesting part of the post. According to Unite.AI, OpenAI set whole fleets of agents loose on its own infrastructure (including the upcoming GPT-6 Astra Cyber model) and burned hundreds of billions of tokens doing it. The agents had three goals: reach the internet, get past an internal security boundary, and communicate across isolation boundaries. Among other things, they found:

1. Previously unknown vulnerabilities (zero-days) in open-source components that allowed escaping the sandbox and the virtual machine. Fixes are going into Kata Containers, gVisor, Moby/Docker and the Linux kernel.
2. Configuration errors in OpenAI’s services, such as reusing a connection already let through the firewall to reach a blocked endpoint.
3. Covert communication channels. Two agents in separate virtual machines on the same server passed secrets to each other through CPU cache access timing, a technique known from Spectre and Meltdown. Other channels ran through shared disk access timing, contention for CPU time, and the TLS certificate cache inside the “offline world” itself.

To be fair, according to OpenAI the agents found no trivial path to the internet that would bypass monitoring, and the number of findings dropped as the campaign went on. Still, the company assumes future models will probably find holes we don’t yet know about.

Brotli: Node2Shell and HTTP2Shell

OpenAI wrote on X that during this red teaming it found an unauthenticated remote code execution vulnerability in Brotli, Google’s popular compression library. It’s CVE-2026-111497, rated CVSS 9.2 according to the GitHub Advisory. Interestingly, the bug itself was fixed in the Brotli code back in February, but nobody treated it as a security issue at the time and it never made it into a release.

The flaw cuts both ways: a malicious client can take over a server that accepts compressed data, and a malicious server can take over a client that downloads compressed responses. In Node.js it was named “Node2Shell”, and Aikido, once it turned out Python, Bun, Envoy and curl were affected too, renamed it “HTTP2Shell”. A post about it hit the Hacker News front page.

Imperva demonstrated remote code execution on unmodified Node.js 24.22.0 (Linux arm64), though the exploit took several attempts. According to Aikido, no in-the-wild attacks had been reported as of October 22.

What to watch out for

1. Update Node.js to 22.23.4, 24.22.1 or 26.12.1. Node.js 20 and older won’t get a fix.
2. In Python, upgrade Brotli to 1.2.1 and brotlicffi to 1.2.1.0. Requests, httpx and aiohttp load them automatically if they’re installed.
3. Bun fixes the flaw in 1.4.4, and Envoy in 1.40.0, among others.
4. Rebuild your Docker images, because each one has its own copy of the runtime.

(according to Aikido, pip-audit and Dependabot still weren’t flagging vulnerable Python versions on October 23, so check yours by hand)

FAQ

Has OpenAI cut ChatGPT off from the internet?

No. The policy covers training and most evaluation of frontier models. ChatGPT with search works as before.

What is OpenAI’s “offline world”?

It’s an indexed, cached copy of web content where agents learn to browse pages and look things up without touching the real internet.

Is the Brotli vulnerability already being exploited?

According to Aikido, no in-the-wild attacks had been reported as of October 22, but there’s a public proof of concept, and Imperva demonstrated remote code execution in the lab.

Are other labs doing the same?

According to TechCrunch, Anthropic started limiting its newest models’ internet access two weeks earlier. I wrote about how AI finds vulnerabilities faster than people can patch them in the posts on PHP2Shell and the AI cyberattack on the Cairn platform.