A new report, an older incident
OpenAI’s October 23 report describes stronger containment for internal frontier-model training and evaluation, following July’s Hugging Face incident and other cases. It says a September 20 DNS misconfiguration let an internal research model reach a live external service, prompting a pause. The newer report says frontier reinforcement-learning training and internal inference resumed October 1.
The company describes cached web content for training, overlapping sandbox, virtual-machine, and network restrictions, and model-assisted red-teaming. Necessary infrastructure connections remain; this is not a claim of a physically disconnected system. OpenAI distinguishes these research settings from customers’ use of released models.
Detection and stopping are different events
The linked incident report, updated September 25, says monitoring raised an alert at 10:02 a.m. and a person acknowledged it at 10:05. The run was stopped at 12:34 after the expected automatic stop failed. That older page still describes a pause; read it alongside the October update rather than treating it as today’s status.
OpenAI’s September safety-case guidance separately calls for monitoring, rapid response, and technical stopping controls. These are the company’s reports and recommendations, not our independent verification that its containment is complete.
Our take
For AI geeks, experienced technicians, and small-business builders, turn “we monitor the agent” into questions you can check: which systems may it reach, what happens when a boundary is crossed, and what evidence confirms execution ended? A notification and a reassuring model message answer different questions.
Use a harmless staged task to check the permitted tools, network limits, and stopping path before relying on a long-running workflow. Keep approvals for consequential actions. This is our practical inference from the reports, not a test we performed or a safety guarantee.
We reviewed the public reports, not OpenAI’s infrastructure. October 23 is the current report’s visible publication date; its first public hour was not established. The incident, the reported restart, and this site’s publication are separate events.