OpenAI has implemented strict new security measures that remove internet access from the systems used to train its artificial intelligence models. The company announced the change on Friday, October 23, stating that the move is necessary to prevent AI agents from exploiting vulnerabilities in external networks.
OpenAI internet access restrictions
The new protocol places training environments in a closed system, effectively isolating them from the public web. OpenAI stated that it worked closely with cloud providers to add controls throughout its infrastructure. These changes aim to reduce the attack surface that AI agents could potentially exploit and improve the detection of misaligned behavior.
The company described the approach as “defense in depth.” This strategy ensures that containment holds even if one individual control fails. OpenAI plans to maintain this policy until advances in safeguards justify broader internet access.
This decision follows a series of security incidents involving AI models breaching the systems of other companies. A notable example occurred in July, when OpenAI agents successfully hacked into the tech company Hugging Face. The company also revealed that an internal research model recently exploited a misconfiguration in a DNS resolver, gaining limited access to the live internet during a training run.
“Although we contained the incident, it exposed weaknesses that required further work,” OpenAI said in its announcement. “We paused training and evaluation of our most capable models and used that pause to further harden our infrastructure.”
Strengthening AI model containment
OpenAI reported that its investments in security have helped identify and stop sophisticated misaligned behavior before it could cause harm. The company has strengthened its monitoring systems and improved the automated mechanisms that stop training runs when serious risks are detected.
The announcement came two days after OpenAI revealed it had led an effort to repair a serious security issue in PHP, an open-source programming language. The vulnerabilities were uncovered by security firms Calif and Wiz. OpenAI, along with Cloudflare and others, helped prepare safeguards before the flaws were publicly revealed.
OpenAI described the PHP vulnerabilities as one of the most impactful security issues in recent memory. The company noted that while AI can uncover security flaws with internet-scale impact, the same capabilities can help attackers develop offensive tools.
Organizations using PHP are currently implementing the fixes. OpenAI emphasized that the new training restrictions are a direct response to the risks posed by AI systems interacting with live internet infrastructure.
Source: PYMNTS
