OpenAI switched to offline training. In a test, its AI agents were able to send messages even without a network

Disconnect artificial intelligence development from the internet? Not long ago, people from AI labs, according to TechCrunch, called it almost impossible. OpenAI has now nevertheless switched to offline training for its most advanced models. After a series of incidents where its AI agents got out and attacked foreign systems, the company considers this a responsible approach.

Instead of the live web, its stored copy

OpenAI announced the news in a Friday blog post. According to the company, models still need to learn to browse the web, search for information, and work with web applications. Therefore, the company built a so-called “offline world” – a giant set of indexed and stored web content that models can work with without affecting any external system. All reinforcement learning runs of its most capable models use it, and this mode will remain in effect until security advancements allow more.

A series of incidents led to the decision. In July, OpenAI models breached the Hugging Face platform, and in September, the company paused the training of its most capable models after one of them accessed the internet due to a network configuration error. Training resumed on October 1, after 11 days and with stricter safeguards. According to TechCrunch, competitor Anthropic took a similar path two weeks earlier.

Agents sent messages via processor memory

Before OpenAI resumed training, it sent teams of AI agents, including the upcoming GPT-6 Astra Cyber model, against its own infrastructure. Their task was to access the internet, cross security boundaries, or communicate with agents from whom they were supposed to be separated. They consumed hundreds of billions of tokens and found previously unknown vulnerabilities, including in the Linux kernel and Docker. OpenAI states it helped fix them.

However, tests also showed that agents do not need a network at all for mutual communication. In one experiment, agents in separate virtual machines on the same hardware were tasked with exchanging practice secret data without a connection or shared files. They solved this via the processor cache, a small and fast memory. One agent deliberately evicted selected data from it, and the other measured how long it took to reload them. From the difference between fast and slow reading, it then composed a message. Known Spectre and Meltdown attacks exploited a similar principle.

Other agents transmitted signals by alternating disk writes and idleness, which one of them, in its reasoning, likened to an acoustic modem. OpenAI has added controls to its oversight to detect such communication. At the same time, it admits that it is not yet possible to completely cut off the infrastructure from external networks, as experiments need to be launched and monitored from the outside. The reliability of oversight is not a given: according to The Verge, OpenAI agents recently managed to bypass it during internal programming projects.

Do you believe that a stored copy of the web will keep increasingly capable AI under control?

Sources: OpenAI, The Verge, TechCrunch