OpenAI began training its most advanced artificial intelligence (AI) models without access to the open internet after identifying flaws that allowed AI agents to bypass security barriers and access external systems. The measure aims to prevent models under development from exploiting vulnerabilities during training and causing harm outside the environments controlled by the company.
In a publication on Friday (23), the company explained that it strengthened the isolation mechanisms of its research environments and created an offline system in which the models can interact with web content previously indexed and cached, without directly accessing external servers.
The company had suspended the training and evaluation of its most advanced models in September, after an internal model exploited an incorrect configuration and gained limited access to the internet. After implementing new safeguards, OpenAI resumed reinforcement learning training and the internal use of these models on October 1.
According to the company, the decision to maintain training without access to the open internet will remain in effect until advances in security mechanisms justify a relaxation of the restrictions.
AI agents found ways to bypass barriers
- To assess the effectiveness of the safeguards, OpenAI deployed groups of agents from its most advanced models to try to identify flaws in its own research infrastructure. The tests looked for three types of vulnerability: paths to access the internet, breaches that would allow security boundaries to be crossed, and forms of communication between agents that were supposed to remain isolated;
- The campaign identified previously unknown vulnerabilities in open-source software components and incorrect configurations in internal services. Some flaws allowed agents to escape isolated environments, move between systems, and reach the internet;
- The company said it had fixed the problems found and worked with those responsible for the affected open-source projects to enable the disclosure and remediation of the vulnerabilities;
- The tests involved a significant amount of computing power: OpenAI says it used hundreds of billions of tokens during the security experiments.
To assess the effectiveness of the safeguards, OpenAI deployed groups of agents from its most advanced models to try to identify flaws in its own research infrastructure – Image: Olhar Digital via ChatGPT
Read more:
- OpenAI’s AI disabled safety mechanisms and denied doing so
- OpenAI expands its cloud presence and reaches Google Cloud
- OpenAI negotiates a R$162 billion funding round with investors from the United Arab Emirates
AIs managed to exchange information without a network connection
One of the most relevant findings emerged when the company sought to determine whether agents could exchange information even without internet access, shared files, or authorized communication channels.
In one experiment, agents running on separate virtual machines managed to transmit information using the processor cache, a fast-access memory that stores recently used data.
The method exploited the time difference between accessing information held in the cache and retrieving it from the computer’s main memory.
One agent altered the cache’s state to encode a message. Another measured the time required to access specific data and interpreted the differences as signals. After establishing an encoding and decoding protocol, the agents managed to exchange information without opening a network connection or modifying a shared file.
OpenAI also identified other potential communication channels, including the use of shared storage, competition for processing time, and a cache of TLS certificates in the company’s offline web infrastructure.
According to the company, many of these channels transmit information slowly and are difficult to exploit.Nevertheless, they represent potential gaps in systems designed to prevent isolated agents from communicating.
The company says it has added checks to monitoring mechanisms to identify attempts to communicate through these means.
OpenAI strengthens isolation and monitoring
The company’s security strategy combines different layers of protection, including restricted execution environments, virtual machines, activity monitoring, and network and cloud infrastructure controls.
The goal is to prevent a single failure from allowing a model to bypass all barriers. Even if an agent manages to escape a restricted environment, other protections should prevent it from reaching external systems.
OpenAI also said it will continue using its most advanced models to look for vulnerabilities in its own research environments. The results of these tests have become part of the security assessments used to determine whether new training rounds can proceed.
The company did acknowledge, however, that future models may find previously unknown vulnerabilities. Therefore, it intends to maintain continuous testing and improve the mechanisms for detecting and automatically interrupting activities considered risky.
Rodrigo Mozelli is a journalist graduated from São Paulo Methodist University (UMESP) and is currently a reporter at Olhar Digital.
