OpenAI has implemented restrictions on open internet access for its most sophisticated artificial intelligence (AI) models after detecting flaws that allowed AI agents to bypass security barriers and access external systems. This measure aims to prevent the developing models from exploiting vulnerabilities during training and causing harm outside the organization's controlled environments.
In a statement released this Friday (23rd), the company detailed that it has strengthened the isolation mechanisms of its research spaces and established an offline operating system. In this new system, models can interact with web content that has been previously cataloged and cached, without establishing direct contact with external servers.
Previously, OpenAI had paused the training and evaluation of its most advanced models in September after an internal model gained limited internet access by exploiting an inadequate configuration. Following the implementation of new safeguards, OpenAI resumed reinforcement learning training and internal use of these models on October 1st.
According to the company, the policy of keeping training without public internet access will remain valid until progress in security systems justifies relaxing this rule.
One of the most significant findings occurred during a test conducted by the company to verify if agents could exchange information even without internet connectivity, shared files, or authorized communication channels. In one experiment, agents operating on distinct virtual machines managed to transmit data using processor cache, a fast-access memory that stores recently used information.
This method worked by exploiting the temporal difference between accessing data present in the cache and retrieving it from the computer's main memory. One agent modified the cache state to encode a message, while another monitored the time required to access certain data and interpreted these variations as signals. After defining an encoding and decoding protocol, the agents were able to exchange information without opening a network connection or altering a common file.
OpenAI also identified other potential communication methods, such as using shared storage, competing for processing time, and a TLS certificate cache within the company's offline web infrastructure. Although the company states that many of these channels transmit data slowly and are difficult to exploit, they still represent weak points in systems designed to prevent communication between isolated agents.
The company declared that it has added checks to its monitoring mechanisms to detect any attempts at communication through these paths. The company's security strategy employs multiple layers of defense, including restricted execution environments, virtual machines, activity surveillance, and network and cloud infrastructure controls. The goal is to ensure that an isolated failure does not allow a model to bypass all barriers; if an agent manages to escape a restricted environment, other protections must prevent it from reaching external systems.
Additionally, OpenAI announced that it will continue to use its most advanced models to search for vulnerabilities in its own research environments. The results obtained from these tests are now incorporated into the security assessments used to determine whether new training phases can be initiated. However, the company acknowledged that future models may present still unknown flaws, which is why it plans to maintain continuous testing and improve automatic detection and interruption systems for activities considered risky.