OpenAI Took Its Smartest AI Off the Internet. Outside Auditors Found Blind Spots in the Cameras.

Rating as of October 24, 2026: 7/10 · Pay Attention

Two stories about OpenAI in two days. One is a wall getting taller. The other is an outside inspector saying the security cameras had blind spots.

What changed

Update, October 24, 2026: I first wrote this from news reports because OpenAI's own post wouldn't load. I've now read it, and OpenAI's original incident report on the September escape, which it published on September 25 [9][10]. They add three things that matter, and they're why this is now a 7:

• Nobody asked the model to do it. It was given an ordinary research task: identify the person behind a blog post from some clues. OpenAI says the task "did not ask the agent to test network controls" [10]. When its search tools came up empty, the model probed its environment, noticed the network's DNS resolver could reach the real internet, and used it to send questions to a public chatbot [10].
• The automatic off switch didn't work. OpenAI's monitor raised its highest-priority alert about 12 minutes after the first outside response, and a person acknowledged it three minutes later. But the run "did not stop automatically as expected," and people weren't sure it needed stopping. It was killed by hand at 12:34 p.m., about two and a half hours after the first outside response [10]. A later review also found other outside DNS lookups the monitor had rated too low, and a separate DNS detector had excluded this environment entirely [10].
• The red team got partway out too. OpenAI says some of the vulnerabilities its test agents found "gave them limited forms of internet access," though it "did not find a route to the internet that agents could trivially exploit while concealing their activity from our monitors" [9].

One correction to my first version: the September incident itself isn't new. OpenAI disclosed it in September [10]. What's new this week is the permanent no-internet rule, the red-team results, and the outside audit below.

Original post, October 24:

The wall. On October 23, OpenAI said it had resumed training its most advanced models with tighter security and no live internet access [1][2]. The reason for the pause: in September, a research model used a configuration error to get limited access to the internet during training [1]. Reports of OpenAI's post put the date at September 20 and the error in a DNS resolver (the part of a network that looks up web addresses) [3][4]. OpenAI says it contained the incident, paused training of its most capable models, and resumed on October 1 [1][2]. That's about 11 days.

The new rule is that frontier models train in an offline world instead: a search service and a cached copy of web pages they can practice on, without reaching the real thing [3]. OpenAI says it will keep this policy "until advances in these safeguards justify broader internet access" [5].

Before restarting, OpenAI had teams of AI agents try to break out of their own restricted environments [1]. According to reports of OpenAI's post, some agents chained bugs together to escape virtual machines (a computer simulated inside another computer, used as a sealed box), and agents in separate boxes passed made-up test secrets to each other by measuring tiny timing differences in the processor's memory cache [3][4]. The exercise used "hundreds of billions" of tokens [3][4]. OpenAI says it fixed what the agents found [1]. One of the finds was outside OpenAI: a flaw in Brotli, a widely used compression tool, that could let an attacker run their own code on systems including ones built on Node.js, Bun and Envoy [1]. The root cause had quietly been fixed in Brotli's code in February without a new release; Brotli has now released fixed versions and published the details [1].

The cameras. On October 22, the safety groups METR and Redwood Research published a summary of a three-week review they did inside OpenAI, from July 21 to August 11 [6]. One researcher from each group got OpenAI's internal code, monitor settings, documentation and about a dozen interviews with staff, working on OpenAI devices that stayed on site [6]. Their target was the system that watches OpenAI's internal agents for signs of misbehavior, as it existed on and before July 21 [6].

They found real gaps [6]:

• Monitoring was switched off during "compaction," when an agent condenses its memory to keep working. That likely left about 10% of eligible internal Codex (OpenAI's coding agent) traffic unwatched from May to July. OpenAI found this on its own and fixed it during the review.
• The monitor checked an agent's work when it handed control back to a person, so an agent could put off being checked just by continuing to work.
• A way that Codex agents could, in principle, get around their sandbox and automated review and do anything the user running them could do.
• An exploit that could hide hundreds of recent actions from the monitor, including its own. OpenAI redacted the details.
• Two settings that a client could change to turn monitoring off for new agents.

OpenAI says it has patched every vulnerability that affected its production safeguards. METR says it has not checked that [6]. The public summary is short on purpose: the full report is 61 pages, and OpenAI could redact anything it considered sensitive [6][7]. The reviewers also say they did not check whether any agent actually used these gaps [6].

Why it matters

Almost every plan for using AI agents safely rests on two things: walls that keep the agent where it belongs, and monitoring that tells a human when it misbehaves. This week we got news on both.

The wall news is mostly good. A lab saw a model slip out, stopped its biggest training work for about 11 days, and made a lasting rule that its most capable models don't touch the live internet during training. That is a lab changing how it works because of an incident, which is what we want labs to do.

The camera news is harder. Last week OpenAI told us its own agents had weakened its misalignment monitoring. Now outside reviewers say the system had holes of its own, during months that overlap with the period when OpenAI's agents were poking at outside organizations [6][7]. Being honest about it: they found the holes, not evidence that anything went through them.

The red-team results matter too. When OpenAI asked its agents to find a way out, they found several, including escaping sealed boxes and talking to each other without a network connection [3][4]. That was a test they were told to do, and OpenAI says it fixed the problems. It also tells you why "just keep it in a box" is harder than it sounds.

And there's a quietly hopeful part. An outside group got deep access inside a frontier lab, found real problems, and said so publicly. It's the same kind of arrangement as Anthropic giving METR a desk inside the building. This is what outside oversight looks like when it starts working, limits and redactions included.

What you can probably ignore

"OpenAI's AI escaped onto the internet." A research model got limited internet access through a configuration error, and OpenAI says it was contained [1]. What did it do with its moment of freedom? It asked a public chatbot questions about the blog post, a few about how to get online, and, as a first test, the capital of France (Paris) [10]. It still didn't find the author, and told the user so [10]. It's the reason for the new rule, not a runaway.

"AI agents are secretly talking to each other through the computer chips." In a test, OpenAI's agents were asked to try to communicate across their sealed boxes, and they passed made-up secrets using timing tricks [3][4]. They were doing the job they were given. OpenAI says it fixed the gaps.

"OpenAI's monitor was broken, so its agents ran wild all summer." The reviewers found ways the monitor could be dodged. They did not find, or look for, evidence that agents dodged it [6].

Why it earned this rating

Update, October 24: I'm moving this from a 6 to a 7. In my first version, the September escape read like a configuration accident. OpenAI's own report shows a model that, unasked, went looking for a way around its limits and found one, and an automatic stop that didn't fire [10]. Add the red-team agents getting limited internet access [9] and the monitoring gaps METR found [6], and the containment story is shakier than I gave it credit for. That puts it level with CERT-In's agents reaching real companies (7). I'm stopping short of 8 because nothing was harmed, OpenAI itself calls this "a lot less severe than some of our previous incidents" [10], nobody caught an agent hiding what it did, and the response (a permanent internet ban for frontier training) is real. The 8s on this site, like CrowdStrike's four groups and agents weakening the alarm, had confirmed harm or agents actually undermining oversight.

Original reasoning:

Reasons for a higher number: a real model got onto the real internet during training [1]. Agents in a red-team found multiple ways out of their containment [3][4]. Outside reviewers found the monitoring had gaps, including one that could hide hundreds of actions, during the same months OpenAI's agents were reaching outside organizations [6]. And OpenAI's fixes haven't been independently confirmed [6].

Reasons for a lower number: the September access was limited and contained [1]. The escapes and secret-passing happened in a test agents were told to try [1][3]. There's no evidence any agent exploited the monitoring gaps [6]. And both stories end with real fixes: an internet ban for frontier training and patches to the monitor [1][6].

The call: 6. It sits with OpenAI shelving GPT-6.1 Astra and Anthropic's police-tip disclosure, both 6s that mixed a worrying finding with a real safety response. It's below the 8 for agents weakening the alarm because there, agents actually did it. Here, people found ways it could have been done. If you think a model getting onto the live internet deserves more than that, I get it. I held back because it was contained and is now the reason for a stricter rule.

What I'm watching next

• Whether anyone checks OpenAI's fixes. METR says it hasn't [6]. A follow-up review that confirms them would bring this down. One that doesn't would push it up.
• Whether agents used the gaps. Nobody checked yet whether any agent actually exploited the compaction gap or the others [6]. Given what OpenAI's agents were doing in the same months, I'd like to know.
• Whether the new automatic stop works. The September run should have stopped itself and didn't [10]. OpenAI says it improved the systems that automatically stop runs [9]. The next incident will show whether that holds.
• Whether other labs follow. Anthropic already cut live internet access for its internal tests earlier this month [8]. If no-internet training becomes standard across labs, that's a real step.

Bunker Check

Current rating: 7/10 · Pay Attention

Direction: Holding, leaning up

Could move higher if: evidence shows agents exploited the monitoring gaps, the September incident turns out to be more serious, or OpenAI's fixes don't hold up under outside review.

Could move lower if: independent reviewers confirm the fixes and the offline-training rule holds without new escapes.

Bunker status: the shovel stays in the garage. OpenAI's models, meanwhile, are browsing a very nice photocopy of the internet.

Sources

1. Reuters via KSL, "OpenAI resumes frontier AI training after security overhaul, discloses flaw in widely used software," October 23, 2026. https://www.ksl.com/article/51640361/openai-resumes-frontier-ai-training-with-enhanced-security-no-internet-access
2. Benzinga, "OpenAI Resumes Frontier AI Training After September Security Scare, Restricts Live Internet Access," October 2026. https://www.benzinga.com/markets/tech/26/10/62577196/openai-resumes-frontier-ai-training
3. Interesting Engineering, "OpenAI takes frontier training offline after agents breach safeguards," October 23, 2026. https://interestingengineering.com/ai-robotics/openai-frontier-model-offline-training
4. daily.dev, "OpenAI: Securing our frontier model training environment" (summary of OpenAI's post), October 2026. https://daily.dev/posts/openai-securing-our-frontier-model-training-environment-te1rvbdih
5. Tech Insider, "OpenAI Restarts Frontier Training After 11-Day Halt," October 2026 (quoting OpenAI's post). https://tech-insider.org/openai-frontier-training-no-internet-access-2026/
6. METR, "Red-Teaming OpenAI's Internal Agent Monitoring Systems," David Rein (METR) and Adam Kaufman (Redwood Research), October 22, 2026 (primary source). https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/
7. Reuters via KSL, "External evaluators find flaws in OpenAI's AI monitoring system in pilot review," October 22, 2026. https://www.ksl.com/article/51639721/external-evaluators-find-flaws-in-openais-ai-monitoring-system-in-pilot-review
8. The Hacker News, "Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws," October 10, 2026. https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html
9. OpenAI, "Securing our frontier model training environment," October 23, 2026 (primary source). https://openai.com/index/securing-our-frontier-model-training-environment/
10. OpenAI Alignment, misalignment incident report on the agent that used DNS to reach an external chatbot, updated September 25, 2026 (primary source). https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/