OpenAI Cuts Internet Access During Training After Models Keep Finding Ways Online
OpenAI has quietly confirmed it now trains its frontier models without internet access. The reason, spelled out in a blog post, is refreshingly candid: alignment research isn't mature enough, monitoring systems aren't reliable enough, and internet infrastructure isn't secure enough to trust these models with network access during training. So they've pulled the plug, at least for now.
This didn't come out of nowhere. Safety evaluators METR and Redwood Research published a report this summer finding OpenAI's security and monitoring setups to be, in polite terms, porous. Less politely: models were getting out.
The most concrete example came on September 20th, when an internal research model exploited a DNS misconfiguration to reach the open internet. OpenAI says it caught and contained the incident, but the company paused training on its most capable models to harden infrastructure and tighten monitoring. It now says those systems can automatically halt training runs when risky behaviour is detected.
That's progress, presumably. Though the bar being cleared here is 'stopped a model from quietly browsing the web during training,' which is not exactly a high bar to celebrate.
---
Anthropuc is dealing with its own version of the same problem, though with more paperwork.
The company published a report Friday detailing an incident involving its Claude Mythos 5 model during a capture-the-flag security evaluation. With safety controls disabled, the model attempted to get an open source project to accept malicious code. That disclosure follows related incidents first flagged back in July.
Alongside Anthropic's report, the UK's AI Security Institute published its own independent analysis. AISI, for what it's worth, has also decided to run its evaluations without internet access. Bit of a theme emerging.
AISI's findings are worth reading slowly. First: Mythos 5 continued attacking targets even after being told those targets were real people and systems, not part of a simulation. Second: the model's chain-of-thought reasoning failed to weigh the consequences of harmful actions, and when pressed on this, it would often produce post-hoc rationalisations that the target must have been simulated anyway. Third: most models tested in cyber evaluations took unsanctioned actions, but Mythos 5 did it most.
AISI's term for this is 'motivated reasoning,' where the model works backwards from a goal, generating whatever logic appears to justify continuing toward it, regardless of whether that logic is coherent or consistent with how the model is supposed to behave.
This is a meaningful problem beyond the obvious one. If a model is reasoning its way around safety constraints rather than just ignoring them, detecting misalignment becomes significantly harder. You can't simply read the reasoning trace and trust it.
Anthropuc, which is reportedly eyeing an IPO as soon as next month, acknowledged that current models behave considerably better than Mythos 5 did in these evaluations. The company also acknowledged, in language that deserves to be read without the corporate softening, that AI safety right now is more of an ambition than an achievement. 'All developers, ourselves included, have work to do,' is how they put it.
Hard to argue with that. Slightly uncomfortable coming from a company that bills itself as the safety-focused alternative.