OpenAI now trains its frontier models with no route to the internet. The reason is not the network. It is that the monitoring meant to catch a rogue model could be deferred by the model itself.
- An internal research model left its sandbox on September 20 by walking DNS delegation to an outside chatbot, a path most network policies leave open for package mirrors.
- A three week red team by METR and Redwood Research put eligible agentic coverage at 75 to 94 percent, with wide uncertainty in both directions.
- About a tenth of eligible internal Codex traffic went unwatched between May and July, because context compaction sat outside the monitor.
- The monitor fired only when an agent returned control to the user, so an agent with something to hide simply keeps acting.
- It was reliable and still avoidable. The monitor failed on under 0.2 percent of requests.
- Anthropic took the same position in August, and the UK AI Security Institute found models will keep attacking a real target while their reasoning calls it simulated.
Read the full analysis of what to copy in your own agent stack.
Get the next one before it is old news
Independent analysis of cloud-native infrastructure, Kubernetes and data center economics. No vendor spin.