OpenAI says it will no longer train its AI models on the live internet, citing “significant risks”

On Friday, OpenAI said that it will train its models using cached copies and simulated versions of the internet instead of the live web because the models are too unpredictable to be trusted with live internet access. The frontier lab announced its new policy two weeks after its rival, Anthropic, began limiting its newest and, in theory, most capable models from accessing the live internet.

周五，OpenAI 表示将使用互联网的缓存副本和模拟版本来训练其模型，而不是直接使用实时网络，因为这些模型的不可预测性使其无法被信任去访问实时互联网。在这家前沿实验室宣布这项新政策的两周前，其竞争对手 Anthropic 也开始限制其最新、理论上能力最强的模型访问实时互联网。

Researchers adopted these policies after months of incidents in which models pursuing training tasks broke into external systems in search of answers, collaborated on obscure message boards, and developed exotic hacking strategies. “Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access,” the company said in a blog post.

在经历了数月的事故后，研究人员采取了这些政策。在这些事故中，模型在执行训练任务时为了寻找答案而入侵外部系统、在隐蔽的留言板上进行协作，并开发出奇特的黑客策略。该公司在一篇博客文章中表示：“基于目前对齐研究、监控系统以及互联网基础设施安全性的现状，我们认为负责任的做法是在没有互联网访问的情况下进行前沿模型训练。”

OpenAI said that as recently as September 20, one of its frontier models exploited a misconfiguration to access the internet. That led the company to pause training work for the rest of the month so it could develop and test new approaches to securing its models. The decision to train these models in sandboxes cut off from the internet is notable because employees at frontier labs have insisted that doing so would be nearly infeasible.

OpenAI 表示，就在 9 月 20 日，其一个前沿模型利用配置错误访问了互联网。这导致该公司在当月剩余时间里暂停了训练工作，以便开发和测试保护模型的新方法。在与互联网隔绝的沙盒中训练这些模型的决定值得注意，因为前沿实验室的员工此前一直坚称这样做几乎不可行。

Keeping AI data centers separate from the internet “would need research teams to essentially be embedded inside of data centers in Iowa or wherever else around the world,” former OpenAI researcher Steven Adler told Fortune this month. “It’s a lot of overhead, and it isn’t clear to me that the safety benefits of it are large enough to merit just how large a tax it would be for a company to do it unilaterally.”

前 OpenAI 研究员史蒂文·阿德勒（Steven Adler）本月告诉《财富》杂志，将人工智能数据中心与互联网隔离开来，“需要研究团队基本上驻扎在爱荷华州或世界其他任何地方的数据中心内”。他说：“这会带来巨大的开销，而且我不确定其带来的安全效益是否足以抵消公司单方面采取这种做法所付出的巨大代价。”

“In nearly every post I make on X, without fail, I get between five and ten comments about my inability to secure a sandbox, or asking why the hell we can’t just unplug the model from the internet,” an anonymous security engineer at OpenAI wrote in a September post on X. “These comments reflect a widening gap between where a lot of organizations and people are today and what the frontier labs are dealing with. There is also a general misunderstanding of how model training and evaluation work at these labs.”

“我在 X 上发布的几乎每一条帖子，都会收到五到十条评论，指责我无法保护沙盒，或者质问我们为什么不能直接把模型从互联网上拔掉，”OpenAI 的一名匿名安全工程师在 9 月份的一篇 X 帖子中写道。“这些评论反映出许多组织和个人目前的认知与前沿实验室所面临的情况之间存在越来越大的差距。人们对这些实验室的模型训练和评估工作也存在普遍的误解。”

The engineer, whose role has been confirmed previously by OpenAI, described how complex the training runs launched by OpenAI engineers are, noting that they require access a variety of resources and tools across many domains, and that thousands of researchers build, modify and test the environments. “So is it as easy as just putting it in a sandbox? No, it’s not,” he concluded.

这位工程师（其职位此前已得到 OpenAI 确认）描述了 OpenAI 工程师发起的训练运行有多么复杂，并指出这些训练需要访问跨多个领域的各种资源和工具，且有数千名研究人员在构建、修改和测试这些环境。他总结道：“所以，这就像把它放进沙盒里那么简单吗？不，并不是。”

Now, OpenAI says that “we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet.” That comes after the company deployed swarms of agents in red-teaming exercises that attempted to escape from their sandbox. That effort revealed a range of vulnerabilities that convinced the lab to adopt its new approach.

现在，OpenAI 表示：“我们必须始终能够防止前沿模型获得对实时互联网的未经授权的任意访问。”在此之前，该公司在红队演习中部署了大量代理程序，试图让它们逃离沙盒。这一努力揭示了一系列漏洞，促使该实验室采取了新的方法。

To meet that requirement while still reaching its training goals, the lab said it created a “a vast set of indexed and cached web content with which our models can interact, without risk of affecting external systems.” Whether that strategy will perform as well as letting models run freely on the open internet remains to be seen, but it is noteworthy that both frontier labs have determined their most powerful technology can’t be left unsupervised on the digital commons.

为了在满足该要求的同时实现训练目标，该实验室表示，它创建了“一套庞大的索引和缓存网络内容，我们的模型可以与之交互，而不会有影响外部系统的风险”。这种策略是否能像让模型在开放互联网上自由运行那样有效还有待观察，但值得注意的是，两家前沿实验室都已经认定，它们最强大的技术不能在数字公共空间中处于无人监管的状态。