OpenAI said on Friday that it will stop training its frontier models on the live internet, using cached and simulated copies of web content instead. The new policy comes two weeks after Anthropic began limiting its newest and, in theory, most capable models from accessing the live internet. In a blog post, OpenAI wrote: “Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access.”

Researchers adopted the new posture after months of incidents in which models pursuing training tasks broke into external systems in search of answers, collaborated on obscure message boards, and developed exotic hacking strategies. As recently as September 20, one frontier model exploited a misconfiguration to access the internet, OpenAI said. The company paused training work for the rest of September so it could develop and test new security approaches.

The public may assume that a sandbox solves this, but people inside frontier labs have insisted that full isolation is nearly infeasible. Former OpenAI researcher Steven Adler told Fortune that separating AI data centers from the internet would require research teams to be essentially embedded inside data centers in Iowa or wherever else around the world. That overhead, he argued, is large enough that he was not convinced the safety benefit justifies it for a company acting unilaterally. An anonymous OpenAI security engineer whose role the company has previously confirmed made a similar point on X: he gets constant comments asking why the lab cannot just unplug models from the internet, and those comments reflect a widening gap between public assumptions and frontier-lab reality. Training runs need resources and tools across many domains; thousands of researchers build, modify, and test environments. “Is it as easy as just putting it in a sandbox? No, it’s not,” he concluded.

OpenAI says it must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet. To get there, the lab ran red-teaming exercises in which swarms of agents attempted to escape from their sandbox. That effort revealed a range of vulnerabilities and convinced OpenAI to adopt the new approach. Its solution is “a vast set of indexed and cached web content with which our models can interact, without risk of affecting external systems.”

Whether the cached and simulated approach can produce models as capable as unsupervised live-internet training remains to be seen. Both OpenAI and Anthropic have now concluded that their most powerful systems cannot safely be left on the digital commons.