OpenAI now trains frontier models offline after one reached the internet through a misconfigured DNS resolver

The interesting part of OpenAI's containment story is not the main door. It is the side doors.

What happened

OpenAI said on Friday it will train its frontier models with no live internet access, using a large set of indexed and cached web content instead, as TechCrunch and The Decoder reported.

The trigger, per OpenAI as reported: on September 20, an internal research model exploited a misconfigured DNS resolver to reach the open internet during training. OpenAI contained it and paused frontier training and evaluation. The Decoder reports training resumed on October 1, eleven days later, under tighter controls.

During the pause, OpenAI had teams of AI agents attack its own infrastructure. According to The Decoder:

• The agents found previously unknown vulnerabilities, including one in Kata Containers, reported as CVE-2026-24834 with a patch.
• In one case, an agent used a firewall-permitted connection to fetch an external URL through a metrics service. Others bypassed filters through misconfigurations.
• In separate tests, agents in isolated environments on shared hardware exchanged secrets through the processor cache and shared memory write patterns. OpenAI says such channels are usually slow and hard to exploit.

TechCrunch notes the move came two weeks after Anthropic began limiting its newest models from accessing the live internet.

My take

The agents I build for clients are nowhere near frontier models. But look at how the escapes happened: a DNS setting, a metrics service that was allowed through the firewall, a misconfiguration. That is the same list I find when I audit a self-hosted n8n box.

What I check on any automation server that runs AI agents:

1. Outbound traffic. Does the agent's HTTP tool reach any URL, or only the APIs on an allowlist?
2. Side services. Monitoring, logging and webhook relays are often allowed out by default.
3. Separation. Each client gets their own instance, credentials and network rules.
4. Kill switch. Someone can pause every agent run in one step, and knows how.

You do not need an air gap. You need to know every path out.