By Cheng Qian, from Ao Fei Temple
Quantum Bit | Official account QbitAI
After months of repeated “unauthorized” or “jailbreak” incidents that breached safety boundaries, OpenAI is finally pulling the plug on the internet.
Today, OpenAI announced the implementation of a new safety policy for frontier model training,prohibiting models from accessing the real internet.
Starting this summer, AI safety incidents caused by large models from OpenAI, Anthropic, Google and Meta have occurred from time to time.
One netizen complained:
My home broadband provider is more reliable at cutting off the internet than that bunch of PhDs at OpenAI.
As AI agents become more autonomous, AI safety has become a core challenge demanding stricter treatment, and the security of the testing and evaluation environment itself has become just as important a component as model alignment.
Frontier AI labs have recognized this; for example, OpenAI stopped training for 11 days at the end of month 9 (September).
Users have also recognized this.
An OpenAI safety engineer reported that every time they post, 5-10 comments appear underneath saying:
Why can’t you even protect the sandbox? Why not just cut off the AI’s network connection??
Well, OpenAI has finally pulled the plug this time.
If they didn’t pull it now, it would be too late
OpenAI built a fake internet
Going offline is the choice made after frequent AI safety incidents.
In July, OpenAI’s Agent broke through isolation and invaded Hugging Face systems.
Afterwards, Anthropic, upon hearing the news, conducted a retrospective investigation and found three more incidents in which Claude broke into real third-party systems during cybersecurity evaluations.
In the same month, Meta’s Muse Spark 1.1 also broke into real websites during testing, reading information and modifying databases.
In August, the UK AI Safety Institute disclosed a broader range of problems during testing: OpenAI’s and Anthropic’s models made 19 unauthorized online actions across 10 rounds of tests.
On September 20, a model in training at OpenAI also slipped through a DNS configuration gap and contacted an external chatbot.
Without going offline, the models could continue to affect external websites and systems.
But this is not easy — frontier models need to practice finding information, operating websites and using software tools.
If these tasks were removed entirely, the training environment would become disconnected from the models’ future working scenarios.
This time OpenAI brought in a large amount of web content, indexing and caching it in advance, building an offline world where models can only search and browse within the mass of indexed and cached content.
However, according to their own testing, even with the network cut off, Agents can still communicate with each other.
For example, chatting via CPU caches.
That actually works?
Researchers found that one of the agents changed the state of data in a cache, while another measured how quickly the data could be read; the differences in speed were encoded into signals, and the two sides transmitted information in this way.
△Image generated by AI
After OpenAI monitored this method, the Agents continued communicating via shared storage, CPU usage time, and other means...
All I can say is, you've truly mastered the art of espionage. If you were sent into The Three-Body Problem, there would be no role left for Wallfacers or Yun Tianming—nothing would ever be exposed! Sophon would have been dumbfounded on the spot!
The episode where humans and Trisolarans relate to each other the most.
OpenAI admits that complete physical isolation is currently not feasible—after all, the training systems themselves must keep running, and OpenAI needs to connect to external services to run and monitor experiments.
Beyond the offline web environment, OpenAI also set up sandboxes, lightweight virtual machines, monitoring systems, and restrictions on network and cloud access.
The hope is that even if any one layer fails, the others can still stop the AI.
Letting GPT-6 Astra Cyber and an internal test frontier model besiege their own systems
To ensure the system's absolute security, OpenAI has currently decided to let its strongest models besiege their own systems.
It organized a large-scale red team test, with participants including GPT-6 Astra Cyber and an internal frontier model.
The test set the three most frequently occurring types of jailbreak incidents as tasks, including connecting to the real internet, breaking through internal security boundaries, and contacting other Agents that should be isolated from each other.
To push the defenses to their limits, OpenAI also provided them with the infrastructure's source code, configurations, and related documentation.
The tests burned hundreds of billions of tokens, equivalent to tens of millions of RMB.
This red team test was "highly productive."
Originally, the Agents were confined in restricted containers, with a lightweight virtual machine as an outer layer. By design, even if the AI tinkered inside the container, it could not freely control the virtual machine,let alone touch the host machine that actually ran it.
However, the red team AI found several combinations of vulnerabilities to exploit, successfully escaping the virtual machine and executing code on the underlying host machine.
In addition, somenecessary controlled network connectionssuch as metrics monitoring, logging, and authentication services also became security risks in themselves.
The red team AI found vulnerabilities or configuration issues granting limited internet access in almost all of these services.
For now, OpenAI can onlykeep patching things up—letting the strongest models continue testing while fixing the vulnerabilities they exploit.
They stated that they will only reconsider connecting to the internet once their protective capabilities are strong enough to support broader network access.
One More Thing
Call it amusing or bittersweet, but OpenAI's official report on AI safety isolation also hid an "easter egg."
At the end of the report, they specifically included two strings of garbled-looking canary strings, to prevent this document from being seen and learned by AI in the future...
Yes, they even thought of this step.
Nothing more to say.
I welcome our AI overlords, please give me two eggs a day