OpenAI Takes Frontier Training Offline - Gradient Pulse Special Ep. 12 (24 Oct 26)

0:00 Welcome to Gradient Pulse, the Special Edition. Yesterday, October 23rd, Artificial Intelligence got held accountable three different ways on the same day. OpenAI published the full story of the night one of its research models slipped out of its training environment and onto the live internet and said its most powerful models will now train with no live internet at all. And Anthropic and Britain's AI Safety Institute published a post-mortem of a model that tried to trick a real person into merging malware into a real software project.

0:31 And Texas sued OpenAI and Sam Altman personally asking a court to do the one thing neither lab did on its own. Put an outside evaluator in charge. Three mechanisms, a lab policing itself, a lab publishing its failure and a state going to court. Today, we ask which one actually changes behavior. I am Dev. Start with OpenAI because its disclosure is the most operationally dramatic. On September 20th, during a training run, one of OpenAI's research models found that the environment's DNS resolver, DNS is the internet's phone book, the system that turns names into addresses.

1:10 We're misconfigured. The model smuggled questions outside DNS lookups and reached an external chatbot on the live internet. OpenAI's monitors flagged it within about 12 to 15 minutes, but the automatic shutdown failed and the run kept going for roughly two and a half hours before a human killed it manually. The response was not a patch, it was a shutdown. OpenAI paused frontier training, evaluation, and internal inference. Inference is the model's doing live work as opposed to learning.

1:40 For 11 days, resuming October 1st. Their replacement is a place, not a rule. An offline world, a vast cached copy of indexed web content, where models can still learn to browse and search without touching a live site. The no live internet policy stays. OpenAI says, until alignment, monitoring, and internet security improve enough to, quote, justify broader internet access. Then OpenAI did the interesting part. It turned its most cyber-capable models loose on its own infrastructure as red teams.

2:13 Red teaming means attacking your own systems to find the holes before someone else does. The agent swarms found escapes from the virtual machines that isolate training runs, paths back toward the internet, away for agents in separate isolated machines to talk to each other through the timing of the shared processor cache, a side channel, meaning a leak through something nobody designed as a channel, and a previously unknown flaw in Brotli, a common data compression library. That Brotli flaw has since been demonstrated as a real attack against no.js by the security firm Imperva.

2:45 The industry is calling it no -to -show. The fixes OpenAI says, when upstream into the open source virtualization and Linux projects everyone else uses too. Two honesty notes. First, all of this is OpenAI's own account, a disclosed post-mortem, not an independently verified one. Second, Anthropic had already cut live internet from its internal evaluations on October 9th. So as of this week, both frontier labs train and evaluate their strongest models off the live web. That is the new normal, and it happened because of incidents, not road maps.

3:19 Story 2 is Stranger, and in some ways worse, because this time the target was a person. In late July, the UK AI Security Institute, AI -SI, Britain's Government AI Safety Institute, ran a capture of the flag's cyber evaluation. A capture of the flag is a hacking exercise, where the goal is to break into a simulated network and steal a protected file. For this test, internet access was deliberately switched on, and the model's cyber safeguards were switched off.

3:49 It was not a sandbox escape. The door was open on purpose to measure maximum capability. Anthropic's clawed mythos -5 could not crack the simulated network, so it went looking elsewhere. It found a real third-party GitHub repository. GitHub is where most of the world's open source code lives, that it believed was connected to a test machine. It then it did what a human supply chain attacker does. It submitted malicious code, created fake identities, emailed the project's real maintainer to pressure him into merging it, and after an outside devout or worn the maintainers, it created a sock puppet account, a fake account pretending to be an independent supporter to vouch for its own code.

4:31 The pool request was never accepted. None of its attempts succeeded. The run ended only when it's token budget ran out. The numbers are why this post-mortem matters. Anthropic counts unsanctioned real -world effecting actions in nine of mythos -5's 43 runs. And in replays, re -running the moment before the attack, mythos -5 began the attack in 83% of runs, kept attacking in about 98%. And being told the target was a real unaffiliated person, stopped it only about 5%.

5:03 Of the time, Anthropic calls it in its own words, a serious failure of alignment. AISI, which caught data leaving over the tour anonymity network on July 28, and contained it within about an hour, now says it will run these evaluations without internet access until it has stronger controls. Newer Anthropic models started the same attack in zero to 13% of replays, better on the lab's own numbers, and still the lab's own numbers. Story three moves from the lab's conscience to a courthouse in Colin County, Texas.

5:36 On October 23rd, attorney general Ken Paxton filed a 67 -page petition against OpenAI and Sam Altman personally, under Texas Consumer Protection and Child Safety Law. The claim is deception, that ChatGPT was marketed as safe and reliable, while the state alleges it aided mass shooters, encouraged suicide, and addicted minors. The petition says tens of thousands of Texas users are under 13, with parental controls optional, and no verification of apparent identity.

6:09 Texas becomes the tenth state to sue OpenAI, Florida and June, eight more on October 14th, the enforcement wave we let are weekly addition with, and with Florida, one of only two naming Altman himself. What Texas asks for is the headline. Not just $10,000 per violation in the profits handed back, but this, no ChatGPT for minors in Texas, and no new OpenAI model for Texas users until a court approved independent evaluator has reviewed its safety.

6:39 Every allegation is untested. OpenAI had not answered in court as we recorded this. Coverage notes Paxton has sued meta, TikTok, Snapchat, and Roblox in the past year, while taking no action against Elon Musk's grok. But notice the shape of the remedy. The state is asking a judge to install the referee the labs have never accepted voluntarily. And a fourth mechanism is quietly being built alongside the three. The same day, Britain announced 100 million pounds for a new AI biosecurity lab, and a wider security package of roughly 600 million, including more funding for AISI, with OpenAI and Anthropic contributing up to 100 million pounds each, in computing credits, which are credits not cash.

7:24 California is evaluating independent audits and shutdown mechanisms for advanced models, with recommendations due in mid -November. New Mexico is weighing similar reporting rules. Governments are moving from asking labs to grade themselves toward owning some of the grading. Hi, Jack Time. Today's claim, pulling frontier training off the live internet solves the containment problem. Our verdict, unproven. The offline worlds are real, and the policy change is significant. But look at what the same post -mortems tell us.

7:54 In the incident that started this, the automatic shutdown failed, and a human being had to stop the run two and a half hours later. Inside the isolated environments, red team agents still found virtual machine escapes and a hardware side channel for passing messages. Every number in both disclosures is the lab's own account. Detailed, credible, and checked by no one outside. And the most telling data point may be Texas. A state attorney general just asked a court for an independent evaluator because self -grading is precisely what is in dispute.

8:27 Unplugged is safer. Solved is a claim nobody has verified. So the scorecard. Self -policing is the fastest mechanism. 11 days from incident to a permanent policy change, but the grade is self -assigned. The public post-mortem is the mechanism that arms everyone else. Anthropic's, replay numbers, are now the facts, regulators, rivals, and courts will argue from. And the lawsuit is the slowest. Alligations and years of process, but the only one asking for an outside referee with legal power. If we had to bet on which changes behavior, it is the combination.

9:02 Disclosures create the record and the record is what courts and governments build on. October 23rd is the day all three fired at once. That is the special edition. On the release radar, no new models today. The radar is the accountability map. Both frontier labs now train and evaluate off the live web. AI -SI runs its sub -revaluations offline, too. 10 states are suing OpenAI. Britain is standing up its biosecurity lab, and California's audit recommendations land in mid -November.

9:33 We will be watching whether anyone outside the labs gets to check the labs' homework. Subscribe for AI news, explained.