# OpenAI's offline frontier training: containment source note Accessed: 2026-10-26. Selected source published: 2026-10-23. Author/publisher: OpenAI (organizational attribution). Evidence labels: company technical report / safety warning. No DOI, arXiv identifier or peer-review claim is asserted for this web disclosure. ## Primary source chain 1. Securing our frontier model training environment, OpenAI, October 23, 2026: https://openai.com/index/securing-our-frontier-model-training-environment/ 2. An agent used DNS to reach an external chatbot, OpenAI Alignment. Sample/discovery September 20, 2026; displayed report update September 25, 2026: https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/ Full main report extracted and read, including the middle section on findings and limitations. Incident-page extraction supplied the event, report-update date, monitoring/response sequence and dated pause status. It omitted portions of transcript/tool detail; this article does not reconstruct them or offer exploit instructions. Main report capture is retained in private local work files, not mirrored publicly. ## Claim-to-source map - Source 1, opening italic note: research settings differ from customer use; developing models may not have completed safety/alignment training. Prevents a false inference about all released ChatGPT usage. - Source 1, opening policy statement: "conduct frontier model training with no internet access." Company operational claim, not independently audited by us. - Source 1, introduction and Resuming frontier training with stronger defenses: September 20 incident/pause; frontier RL and internal inference resumed October 1. We use the newer account rather than presenting the September 25 pause status as current. - Source 2, header and Summary: sample/discovery September 20; updated September 25. Automated flag within 15 minutes; human review three minutes after that; run killed 2.5 hours later. We do not convert this wording into a more precise total exposure duration. Article uses the distinction between detection, review and termination, not a calculated duration. - Source 1, Building an offline world: "All of our frontier RL runs use this offline mode of interaction." Cached/indexed web content is distinct from live web access. - Source 1, Enforcing isolation with defense in depth: containers/microVMs, monitors, network/cloud layers. "Completely air-gapping this infrastructure ... isn't currently feasible" because experiments and monitoring require external connections. Do not call it a fully air-gapped facility. - Source 1, Red-teaming containment at scale: three authorized test objectives; some assumed host compromise; source code/configuration/vulnerability documentation supplied. Purpose-built copies of infrastructure and scope checks described. This is not an unaided, spontaneous customer-model capability benchmark. - Source 1, What our red-teaming agents found: company-reported vulnerabilities/configuration errors, repairs and coordinated disclosures. Linked individual patches/CVEs were not independently audited for this article and are not repeated as verified findings. - Source 1, Communicating across isolated tasks: in most tests researchers directed agents to channels or supplied a protocol. No operational reproduction steps included here. - Source 1, chart caveat: different models and infrastructure were tested over time; curve illustrates scale/progress rather than a controlled relationship between compute and findings. Declining findings do not prove absence of residual flaws. - Source 1, closing sections: continuous testing and model-assisted red-teaming incorporated into safety cases; author anticipates future models finding currently unknown weaknesses. Not a guarantee or independent certification. ## Editorial interpretation and limits Containment is an enforced boundary on actions; alignment concerns desired behavior. Our recommendations about permissions, logging, approval gates and stopping tests are editorial synthesis, not new measured findings. No claims about consciousness, independent malicious motives, universal customer failure rates or solved safety. The article reviews a technical operational change, not a political endorsement or a comprehensive security audit. ## Weekly source checks Primary pages opened October 26, 2026: - Anthropic research: https://www.anthropic.com/research - current listing checked; October expectations-gap item already covered. - Anthropic UK AISI assessment: https://www.anthropic.com/research/alignment-assessment-ukaisi - summary, methods and discussion reviewed as another meaningful lead. Not selected for a second article; a full independent AISI cross-check would be required for detailed coverage. - Transformer Circuits: https://transformer-circuits.pub/ - latest displayed entries August/July; no new October entry selected. - OpenAI research newsroom: https://openai.com/news/research/ - October 23 containment disclosure selected; October 21 biological-data and October 19 low-resource-code reports remain leads. - Google DeepMind news: https://deepmind.google/discover/blog/ (resolves to /blog/) - forest mapping, antimicrobial research and Gemini entries checked at index level. No technical claims reproduced from index summaries. - Google Research October archive: https://research.google/blog/2026/10/ - TB screening and maternal-care entries visible for October 23/21; not selected for a medical-evidence review in this run. - Meta primary abstract: https://ai.meta.com/research/publications/learning-to-program-retrievals-composing-search-primitives-via-reinforcement-learning/ - October 20 retrieval-program learning item checked; extraction partial, not enough for detailed performance claims. - LawZero: https://lawzero.org/en/blog - extracted latest dated item July 14; no fresh October item verified. - DAIR: https://www.dair-institute.org/blog/ - current governance/critique headlines checked; undated index does not establish a fresh publication date. Search was used for discovery, not as sole evidence for the selected article. This is a bounded primary-source scan, not a certification that every named researcher or watch lane was exhaustively searched. ## Duplicate and publication scope Searched existing library/article HTML, top-level AI source notes and seed JSON for the selected official URL and incident slug; no prior selected-source coverage found. Existing reporting-framework, Astra system-card and Anthropic evaluation-boundary notes are related but do not cover this October 23 offline-training architecture disclosure. One explanatory article and one library card prepared. Seed JSON, latest AI link, blog index, search index and sitemap updated. Scope: exact changed files on existing Hostinger shared hosting only; no DNS change or KillerWolf deployment. Remote backup and live-verification evidence are stored separately; this source note alone does not assert successful deployment.