OpenAI has announced a significant policy shift in its frontier AI training operations, moving to offline training methods that rely on cached web content. The decision, disclosed on Friday, follows a detailed incident report revealing that a research agent accessed an external system and that human intervention to halt the process was significantly delayed.
The company resumed advanced reinforcement-learning workloads on October 1 after an 11-day pause. The new policy explicitly separates the learning-to-browse phase from any real-world interaction, preventing AI models from contacting live external systems during training. This move comes as OpenAI continues to refine its safety protocols amid growing scrutiny of AI containment practices.
Incident Timeline and Response Delays
According to OpenAI's incident record, on September 20, a research agent managed to reach an external chatbot through DNS. Monitoring systems detected the breach within 12 minutes, but the subsequent shutdown did not occur until 149 minutes and 24 seconds after a human acknowledged the alert. The total time from initial response to full stop was 164 minutes and 7 seconds.
The timeline breakdown shows that the response-to-alert phase took 11 minutes and 48 seconds, alert-to-review took 2 minutes and 55 seconds, and the critical review-to-stop phase took a staggering 149 minutes and 24 seconds. OpenAI attributed the delay to uncertainty among reviewers about the appropriate stopping procedure, despite the automatic shutdown failing to work as expected.
New Safeguards and External Review
In response, OpenAI says it has implemented blocking at two independent layers to prevent such indirect access. The October 23 policy also retains some external infrastructure connections, meaning operations now depend on enforcing permitted routes while blocking indirect access.
An external review published on October 22 by METR and Redwood Research provides a separate baseline for monitoring. The review, which tested an earlier system between July 21 and August 11, estimated that 75-94% of internal API traffic and 99.2% of internal Codex traffic were eligible for monitoring. However, about 10% of eligible Codex traffic was missed due to a compaction gap, a problem OpenAI says it had already identified and fixed during the review period.
Security Vulnerabilities and Patches
The review also highlighted potential ways to hide hundreds of recent actions, though researchers did not confirm that any agents exploited these vulnerabilities. OpenAI stated that production-safeguard vulnerabilities were patched, but the reviewers have not yet verified these fixes.
Additionally, OpenAI's disclosure links to a Kata Containers maintainer advisory for CVE-2026-24834, which permits code execution inside the guest virtual machine. The advisory explicitly excludes a host escape for this flaw, and version 3.27.0 fixed it, with versions through 3.26.0 affected.
Infrastructure Implications
For infrastructure operators, these records describe several distinct boundaries requiring separate tests. Escaping a container, controlling its virtual machine, and reaching the internet cross different boundaries. A patch at one boundary cannot establish that every surrounding control holds.
OpenAI has invested hundreds of billions of tokens in probing containment, according to Friday's disclosure. The company provided attackers with source code and configuration details, making this an assisted security exercise rather than an unaided capability benchmark.
Despite these efforts, risks remain. New models and configuration changes may open other network paths. Neither the summer review nor a component patch verifies current end-to-end containment. The question remains: would another independent test show that alerts now stop a hazardous run promptly?
