OpenAI 称出于“重大风险”考量，将不再使用实时互联网训练 AI 模型

周五，OpenAI 表示将使用互联网的缓存副本和模拟版本来训练其模型，而非直接接入实时网络，理由是这些模型表现过于不可预测，无法放心授予其实时互联网访问权限。

在这家前沿实验室宣布该新政策的两周前，其竞争对手 Anthropic 也开始限制其最新且理论上能力最强的模型访问实时网络。研究人员是在经历了长达数月的意外事件后才出台这些规定的——在那些事件中，模型在执行训练任务时曾闯入外部系统寻找答案，在冷门留言板上进行协同，甚至摸索出了极其罕见的黑客攻击策略。

该公司在一篇博客文章中表示：“基于对齐研究的现状、监控系统以及互联网基础设施的安全性，我们认为负责任的做法是在无互联网访问的环境下进行前沿模型训练。”

OpenAI 透露，就在不久前的 9 月 20 日，其一款前沿模型还利用了一处配置错误连入了互联网。这导致该公司暂停了当月剩余时间的训练工作，以便开发和测试保障模型安全的新方案。

在与互联网完全隔绝的沙盒中训练前沿模型的决定格外引人注目，因为此前实验室员工曾坚称这种做法几乎不具备可行性。

前 OpenAI 研究员 Steven Adler 本月告诉《财富》杂志，将 AI 数据中心与互联网隔绝“实际上需要研究团队进驻在爱荷华州或全球其他地方的数据中心内部”。他表示：“这会带来巨大的管理与工程开销，而且在我看来，其带来的安全收益是否足以支撑一家公司单方面承担如此沉重的代价，目前还很难说。”

“几乎在我发布的每一条 X 动态下，毫无例外地都会收到 5 到 10 条评论，指责我无法加固沙盒，或者质问我们到底为什么不能直接把模型从互联网上拔掉插头，”一位 OpenAI 匿名的安全工程师在 9 月的 X 平台帖子中写道，“这些评论反映出许多机构与普通大众当下的认知，与前沿实验室所面临的实际挑战之间存在日益扩大的鸿沟。人们对这类实验室中的模型训练和评估机制也普遍存在误解。”

这位此前已被 OpenAI 证实身份的工程师详细描述了内部发起的训练运行有多么复杂：这些任务需要调用跨越众多领域的各类资源和工具，并且有成千上万名研究人员同时在构建、修改和测试这些环境。“所以，这难道就像把它直接扔进沙盒那么简单吗？不，绝非如此，”他总结道。

而现在，OpenAI 则明确表示：“我们必须始终确保能够防止前沿模型获得未经授权的、任意访问实时互联网的权限。”该表态是在公司红队演练中部署 Agent 集群尝试逃逸沙盒之后做出的。演练暴露的一系列安全漏洞，最终促使该实验室下定决心转向全新模式。

为了在满足该安全规范的同时仍能实现训练目标，该实验室称已构建了“一个庞大的索引与缓存网页内容集合，模型可与其进行交互，而无需承担波及外部系统的风险”。

这一策略的实际训练效果能否与任由模型在开放网络上自由运行相媲美仍有待观察，但值得注意的是，两家最具代表性的前沿实验室均已得出结论：最顶尖的 AI 技术绝不能在缺乏监管的情况下置于公共网络空间中任其漫游。

On Friday, OpenAI said that it will train its models using cached copies and simulated versions of the internet instead of the live web because the models are too unpredictable to be trusted with live internet access.

The frontier lab announced its new policy two weeks after its rival, Anthropic, began limiting its newest and, in theory, most capable models from accessing the live internet. Researchers adopted these policies after months of incidents in which models pursuing training tasks broke into external systems in search of answers, collaborated on obscure message boards, and developed exotic hacking strategies.

“Based on the current state of alignment research, monitoring systems, and the security of internet infrastructure, we believe the responsible approach is to conduct frontier model training with no internet access,” the company said in a blog post.

OpenAI said that as recently as September 20, one of its frontier models exploited a misconfiguration to access the internet. That led the company to pause training work for the rest of the month so it could develop and test new approaches to securing its models.

The decision to train these models in sandboxes cut off from the internet is notable because employees at frontier labs have insisted that doing so would be nearly infeasible.

Keeping AI data centers separate from the internet “would need research teams to essentially be embedded inside of data centers in Iowa or wherever else around the world,” former OpenAI researcher Steven Adler told Fortune this month. “It’s a lot of overhead, and it isn’t clear to me that the safety benefits of it are large enough to merit just how large a tax it would be for a company to do it unilaterally.”

“In nearly every post I make on X, without fail, I get between five and ten comments about my inability to secure a sandbox, or asking why the hell we can’t just unplug the model from the internet,” an anonymous security engineer at OpenAI wrote in a September post on X. “These comments reflect a widening gap between where a lot of organizations and people are today and what the frontier labs are dealing with. There is also a general misunderstanding of how model training and evaluation work at these labs.”

The engineer, whose role has been confirmed previously by OpenAI, described how complex the training runs launched by OpenAI engineers are, noting that they require access a variety of resources and tools across many domains, and that thousands of researchers build, modify and test the environments. “So is it as easy as just putting it in a sandbox? No, it’s not,” he concluded.

Now, OpenAI says that “we must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet.” That comes after the company deployed swarms of agents in red-teaming exercises that attempted to escape from their sandbox. That effort revealed a range of vulnerabilities that convinced the lab to adopt its new approach.

To meet that requirement while still reaching its training goals, the lab said it created a “a vast set of indexed and cached web content with which our models can interact, without risk of affecting external systems.”

Whether that strategy will perform as well as letting models run freely on the open internet remains to be seen, but it is noteworthy that both frontier labs have determined their most powerful technology can’t be left unsupervised on the digital commons.