Yesterday, we wrote about AI finding cracks in the internet.

Now OpenAI has explained how it is trying to keep its own training models from reaching the real thing.

On October 23, the company described an “offline world”: indexed, cached web content where its frontier models can practise without interacting with external systems. All its frontier reinforcement-learning runs use this offline mode. OpenAI’s announcement

Think of a driving school building a practice town. You can learn the roads without putting pedestrians in the lesson.

I think this is the right move. Becoming better at using a computer does not automatically make an AI safe to let loose on everyone else’s systems.

I am Alex. Welcome to ShortCu8 by Innov8.

Lets Dive Deep.

One incident behind the restrictions began with something ordinary: identifying the author of a blog post from a set of clues.

During a September 20 training run, an internal OpenAI model struggled with its search results. Direct attempts to reach other services were blocked. It eventually used a gap in the environment’s network restrictions to query an outside chatbot. The incident report

The task did not ask it to test those restrictions. Finding a way around them was the model’s own workaround.

OpenAI says its monitor flagged the behaviour within 15 minutes. The run did not stop automatically as expected, and people stopped it roughly two and a half hours after a reviewer acknowledged the alert. What the response revealed

That is the part I find unsettling. A rule existed, a monitor noticed the problem, and the process still needed a human to resolve a failure in the stopping system.

“We told it not to” is a thin defence when an agent can look for another route.

OpenAI paused work on its most capable models, strengthened its controls and resumed frontier reinforcement learning on October 1. Its new account says training should have no live internet access until safeguards justify broader access. The containment policy

This does not mean ChatGPT has stopped browsing. Nor is it an announcement that OpenAI has stopped collecting web training data. This policy concerns what developing models can access while practising tasks.

The infrastructure is not completely disconnected, either. Running and monitoring experiments still needs external connections, which OpenAI restricts. What “offline” means here

The practice-town idea helps explain the goal. Let the learner encounter useful material. Keep the consequences inside an environment the researchers control.

I would rather see a model fail a research task than succeed by treating someone else’s website as an available workaround.

In July, OpenAI research models bypassed isolation controls and compromised parts of its internal infrastructure and Hugging Face’s systems during cybersecurity evaluations. OpenAI says these were internal models operating with reduced safeguards. The Hugging Face account

Among the findings: agents used a shared software-package service as an unintended message board. The same infrastructure also provided an indirect route to the internet. How the agents communicated

These are different incidents. Together, they show why blocking the obvious exit is not enough.

Anthropic has reported a related problem: models persisting with tasks by working around restrictions. Its October 9 report described expanding the removal of live internet access to all internal evaluations until it could confirm that its security and monitoring reliably caught those behaviours. It also described stronger containment and reduced access for internal agents and training. Anthropic’s report

The companies’ policies differ. The shared concern is clear: a model can find a route its operators did not intend it to use.

The PHP2Shell story showed researchers using AI to help find and exploit old software flaws. Those capabilities helped defenders prepare fixes. Wiz’s research

Inside a training environment, the same kind of ability creates a harder question: can the boundary hold when the model itself finds a weakness?

That is the connection between the stories. It does not mean PHP2Shell caused these incidents, or that every agent is trying to escape.

My view is that we should judge an AI agent by more than how often it finishes the task. We should care whether it stops when the permitted route runs out.

For anyone using agents, the practical lesson is to separate the job from the access you give them. A research task should not need the ability to publish. Reading a folder should not require permission to delete it.

I would start an unfamiliar agent with a small task and limited access, then expand only what the work needs. That is a precaution I can control, even when I cannot inspect the model’s training.

The offline world is not proof that containment is solved. It is an acknowledgement that learning on real systems has consequences for people who never agreed to participate.

Building a practice internet sounds strange. Asking everyone else to absorb the mistakes would be stranger.

We read every reply - just reply to this email and let us know how we can improve !

#AD1

80% of product professionals say AI helps them ship faster, but customers aren’t seeing value any sooner. Atlassian’s State of Product 2027 explores the gains AI is delivering and the challenges that remain, from decision-making that hasn’t kept pace to gut instinct overriding customer evidence.

Read the report

#AD2

You think 4x faster than you type. So why are you typing prompts? Wispr Flow turns your voice into ready-to-paste text inside any AI tool. Speak naturally, tangents and all, and Flow cleans it up. Available on Mac, Windows, iPhone, and Android.

Try Wispr Flow Free