OpenAI now trains its frontier models without live internet access. Here's what that means for you

On Friday, OpenAI said it now believes "the responsible approach is to conduct frontier model training with no internet access," and that it will keep that policy "until advances in these safeguards justify broader internet access" (OpenAI, Oct 23, 2026). It's not a complete air gap. OpenAI says it still keeps some limited external connections, because fully air-gapping its training "isn't currently feasible."

What happened

OpenAI says that on September 20, an internal research model "exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run." The company says it contained the access, paused training and evaluation of its most capable models to harden its infrastructure, and resumed on October 1 (OpenAI, Oct 23, 2026).

Before resuming, OpenAI ran what it calls a high-compute red-teaming campaign: frontier-model agents were told to look for ways to reach the internet or get past their security boundaries. OpenAI says the work found previously unknown software vulnerabilities and misconfigurations, which it says it has fixed.

To teach browsing without the live web, OpenAI says its models now use a large set of indexed and cached web content that they can interact with without affecting outside systems (TechCrunch, Oct 23, 2026). In other words, it's an offline copy of the web.

One finding already affects developers. A critical flaw in the Brotli compression library (CVE-2026-111497) has been fixed upstream and in Node.js, Bun and Envoy. Node.js credits OpenAI Codex Security with the report, and Envoy credits OpenAI Security Research (NVD). OpenAI tied the bug to its red-teaming in a post on X, as reported by WebProNews. If you run those stacks, update: Node.js 22.23.4, 24.22.1 or 26.12.1; Bun 1.4.4; Envoy 1.40.0 or the latest patch of your branch.

Why it matters

• Take the capability signal seriously. A frontier lab is saying its models are good enough at finding security holes that it trains them offline. TechCrunch notes that whether a cached web works as well as the live one "remains to be seen."
• Your agents need guardrails too. OpenAI is describing its research training environments, not the products you use, but the lesson carries over: give an agent only the files and network access each task needs.
• Others are moving the same way. TechCrunch reports that Anthropic adopted a similar policy two weeks earlier. Moonshot AI says it removed cyber-related training data and tasks from its new Kimi K3.1 Pro. Moonshot reports the model scored 81.0% on an internal hacking benchmark (xdev-bench-hard, pass@3), against 90.5% for a version trained without that filter (Kimi blog; also reported by Reuters). Those results haven't been independently verified. Moonshot says the weights will be released by November 4, with a 1M-token context.

Also on our radar

• Block's Dessa is a full-duplex voice model, so it can listen and talk at the same time. Block says it was trained on human speech and runs locally on a MacBook with an M4 Max or better. There's no public access yet, and Block is inviting safety researchers to test it (TechCrunch, Oct 24, 2026).
• AI's payoff gap. Apollo chief economist Torsten Slok wrote that outside the tech sector, there are no signs yet of a financial payoff from AI for US companies (Apollo, Oct 24, 2026). For business owners, the takeaway is to measure results, not hype.

New tools to try

1. Canva Craft: Canva's own image model, launched October 22. Canva says it makes images up to 2K in more than 30 aspect ratios, plans a design before rendering it, and is in Dream Lab and the Canva API, with MCP support coming (Canva newsroom).
2. Ollama speech models: Ollama now does text-to-speech with Phonon, built on Gradium's model, on Apple Silicon Macs, through an OpenAI-compatible /v1/audio/speech endpoint (Ollama docs).
3. NVIDIA Nemotron 3.5 Bolt E4B: a small open model post-trained from Google's Gemma 4 E4B for fast local voice and device assistants. There's a 4GB quantized build, and the license is OpenMDW-1.1 (Hugging Face).
4. Mantid: a free Mac app that trains prediction models or a custom LLM on your own files, locally, with no account. Mantid says it checks every model against the simplest guess and keeps every version (mantid.dev).
5. Anthropic Sandbox Runtime (srt): an open-source (Apache-2.0) tool that limits the files and network a command can reach, without a container. Anthropic calls it a research preview developed for Claude Code. It fits today's headline: if you run agents or MCP servers, sandbox them.

The bottom line

The biggest AI story this weekend isn't a new model. It's a frontier lab saying its models are now capable enough that it trains them without the live internet. Try the new tools, and give your own agents the same kind of limits.

Browse more in our AI tools library.