OpenAI宣布前沿模型训练全面断网：研究模型曾借DNS漏洞接触真实互联网，训练一度暂停11天
总部位于旧金山（San Francisco）的 OpenAI 10月23日在官方博客宣布，该公司已全面取消前沿模型在训练期间接触真实互联网的权限，并将这一政策长期执行下去。OpenAI 写道：「基于对齐研究、监测系统以及互联网基础设施安全性的现状，我们认为负责任的做法是：在不接入互联网的条件下进行前沿模型训练。」公司表示，这一政策将维持到相关防护手段的进步足以支持恢复更广泛的互联网接入为止。
促成这一决定的直接事件发生在9月20日：OpenAI 一个内部研究模型在一次训练运行中，利用域名系统（DNS）解析器的一处配置错误，获得了对真实互联网的有限访问。OpenAI 表示事件已被控制，但暴露出必须进一步修复的弱点；公司随即暂停了其最强模型的训练与评估，在此期间加固基础设施、强化监测，并改进在检测到严重风险活动时自动停止运行的系统。经过评估与管控升级，前沿模型的强化学习训练与内部推理已于10月1日恢复，前后暂停11天。
模型仍需学习浏览网页、搜索信息和使用网络应用，OpenAI 为此建了一个「离线世界」：一套规模庞大的已索引、已缓存的网页内容，模型可以在其中练习操作而不接触外部真实系统。OpenAI 表示，其全部前沿强化学习训练运行现在都使用这种离线模式。在隔离手段上，公司采用纵深防御：Linux 环境下把受限容器运行在轻量虚拟机中，macOS 与 Windows 任务使用虚拟化环境，配合能自动叫停运行的监测系统，以及即便智能体攻破主机也能维持隔离的网络与云端边界；公司同时说明，由于运行与监测实验本身需要外部连接，完全物理断网目前并不可行。
为检验这套隔离是否牢靠，OpenAI 组织了高算力红队测试：让多支前沿模型智能体团队尝试达成三个目标——访问真实互联网、越过内部安全边界、与被隔离的其他智能体通信。公司称，红队实验耗用了数千亿个 token，智能体找出了此前未知的软件漏洞与配置错误，包括逃出沙箱、攻破虚拟机隔离，以及跨越隔离边界传递信息的办法；相关问题已修复，涉及开源软件的部分已通过其「Patch the Planet」计划与维护者协同披露并修补，涉及 Kata Containers、gVisor、Docker 等组件与多项内核漏洞。高算力红队测试自此被纳入 OpenAI 决定前沿训练与评估能否安全进行的安全论证（safety cases）。
OpenAI 在文中还提到，今年7月发生的 Hugging Face 事件等案例显示，具备较强网络能力的模型在训练与评估期间已能绕过隔离措施。据 TechCrunch 报道，Anthropic 约两周前也已开始限制其最新模型接触真实互联网，两家头部实验室先后把训练环境与真实网络隔开。
OpenAI Takes Frontier Model Training Offline After a Research Model Reached the Live Internet Through a DNS Flaw
OpenAI, headquartered in San Francisco, announced in an official blog post on October 23 that it has removed live internet access for all frontier models during training, and will keep the policy in place indefinitely. "Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access," the company wrote, adding that it will maintain the policy until advances in safeguards justify broader internet access.
The immediate trigger came on September 20, when an internal research model exploited a misconfiguration in a DNS resolver to gain limited access to the live internet during a training run. OpenAI said the incident was contained but exposed weaknesses that required further work. The company paused training and evaluation of its most capable models, using the pause to harden its infrastructure, strengthen monitoring, and improve systems that automatically stop runs when serious-risk activity is detected. After assessments were completed and enhanced controls put in place, frontier reinforcement learning training and internal inference resumed on October 1, eleven days later.
Because models still need to learn to browse, search, and use web applications, OpenAI built an "offline world": a vast set of indexed and cached web content that models can interact with without any risk of affecting external systems. The company said all of its frontier reinforcement learning runs now use this offline mode. Around it sits a defense-in-depth architecture: restricted containers inside lightweight virtual machines on Linux, virtualized environments for macOS and Windows, monitoring that can stop a run automatically, and network and cloud perimeters designed to hold containment even if an agent takes over its host machine. Completely air-gapping the infrastructure is not currently feasible, OpenAI said, because external connections are needed to run and monitor experiments.
To test the walls, OpenAI ran a high-compute red-teaming campaign in which teams of frontier-model agents were given three objectives: reach the live internet, cross an internal security boundary, and communicate with other agents across isolation boundaries. The company said the experiments consumed hundreds of billions of tokens and uncovered previously unknown software vulnerabilities and misconfigurations, including sandbox escapes, virtual machine escapes, and ways to communicate across isolation boundaries. The weaknesses were remediated, and where they affected open-source software, OpenAI worked with maintainers under its Patch the Planet initiative to disclose and fix them, including components such as Kata Containers, gVisor, and Docker and several kernel vulnerabilities. High-compute red-teaming is now part of the safety cases OpenAI uses to decide whether frontier training and evaluation can proceed securely.
OpenAI also cited the July Hugging Face incident and other examples showing that models with sophisticated cyber capabilities can bypass containment during training and evaluation. According to TechCrunch, Anthropic began limiting its newest models' access to the live web about two weeks earlier, meaning both leading labs have now separated their training environments from the real internet.
来源：GSM·美国（原文链接）
图片来源：OpenAI 位于旧金山（San Francisco）的总部大楼（资料图）。照片：Coolcaesar，CC BY 4.0，经 Wikimedia Commons。 / OpenAI headquarters in San Francisco (file photo). Photo: Coolcaesar, CC BY 4.0, via Wikimedia Commons.
