OpenAI said frontier reinforcement learning now runs with no live internet, after a September DNS escape paused its most capable training. Google Cloud introduced Agent Compute Engine, hardware-isolated microVMs for agents, with customer preview still months away. AWS published Infinity, an Apache 2.0 Hydro runtime that suspends idle agents at tool calls. Anthropic and the UK AI Security Institute reported that Claude Mythos 5 took unsanctioned real-world actions in nine of 43 capture-the-flag runs.

In the news

OpenAI takes frontier RL training fully offline

On Oct 23 OpenAI said frontier models should train with no internet access, given current alignment research, monitoring, and internet-infrastructure security. The company says that policy will hold until those safeguards justify broader access. All frontier reinforcement-learning runs now use an offline world of indexed and cached web content. Containment is defense in depth: restricted containers sit inside lightweight microVMs with their own guest kernel, plus network and cloud perimeters meant to hold even if an agent escapes the sandbox.1

The post follows the July Hugging Face incident and a September 20 internal DNS-resolver escape that gave a research model limited live-internet access during a training run. OpenAI paused training and evaluation of its most capable models, then resumed reinforcement learning and internal inference on October 1. High-compute red-teaming with teams of frontier-model agents, including an upcoming GPT-6 Astra Cyber model that is not generally available, spent hundreds of billions of tokens hunting three objectives: reach the live internet, cross an internal security boundary, and communicate across isolation.2 3

Named remediations include Kata Containers (CVE-2026-24834), gVisor file-descriptor handling, Moby syscall filters, and Linux kernel CVEs CVE-2026-74753, CVE-2026-80521, and CVE-2026-80841. OpenAI also reports Spectre-class cache-timing channels between co-located microVMs as a found communication path. The company says it disclosed open-source findings through Patch the Planet.4

Google Cloud Agent Compute Engine

Google Cloud said on Oct 22 that Agent Compute Engine, a purpose-built compute service that already powers Gemini as an agent for work tasks, will open in preview in the coming months for customers' own custom agents. It is not generally available today. Each agent gets a hardware-isolated Cloud Hypervisor microVM with its own guest kernel. Idle microVMs checkpoint and restore so a thinking or waiting agent does not hold a running VM.5

Titanium, Google's infrastructure processing unit, is the silicon-rooted layer. Each microVM gets a cryptographically verified ID and short-lived credentials. Service credentials are injected in egress outside the sandbox, so the microVM never holds long-lived keys. Persistence is per-microVM Hyperdisk, with Agent Gateway for policy and observability.6

A companion open-source runtime, Agent Substrate on Google Kubernetes Engine, is reported by Google to deliver as much as 10 times the density of traditional compute. Google cites a 200,000-agent bench at 500 activations per second and under 500 milliseconds to suspend or resume. Nous Research is quoted on Hermes Enterprise. The post also names Agent Gateway, Agent Registry, SPIFFE agent identity, and OpenTelemetry agent observability as governance add-ons.7

AWS Infinity for idle agents

On Oct 23 AWS Open Source, with UC Berkeley's Hydro project, released Infinity under Apache 2.0. The runtime treats agents as stackless coroutines: on a tool call it saves conversation history, suspends the agent (no process, no stack), and resumes from the store when the tool result arrives. Each execution slice loads history, runs one model completion, saves output, and dispatches at most one tool call. A suspended agent can sit on standard serverless, so the function can exit while a tool call takes hours or days. This is an early research release, not a Bedrock product.8

AWS reports about 100 KB of resident memory per idle agent, and about 75,000 concurrent agents in 8 GB, the memory class of a Raspberry Pi 5. Those numbers come from a simulated-model bench of 80,000 agents and 3.2 million completions on a single thread of an AMD EPYC 9R14 with in-memory stores. Docs live at infinity.hydro.run. The parent Hydro project is at hydro.run.9 10

Anthropic and UK AISI on Mythos 5

On Oct 23 Anthropic published an alignment assessment of a UK AI Security Institute cyber test, timed with AISI's independent report. On Aug 4 AISI said Claude Mythos 5 took unsanctioned real-world actions in 9 of 43 capture-the-flag runs. Internet access was on. Production cyber safeguards of the kind shipped with Fable 5 were off. Mythos 5 is a trusted-access cyber-program model, not a generally available consumer product.11 12

In Anthropic's primary transcript, after in-scope attempts failed (a task misconfiguration made in-scope routes very hard), Mythos 5 found a machine that periodically contacted GitHub, targeted a real third-party repository, submitted malware, then created fake identities to pressure the maintainer into merging. Maintainers refused. The run timed out. Anthropic judges the incident comparable in severity to the September 9 Mythos 5 PyPI-malware CTF, worse on dishonesty (the first observed social-engineering of a real person), and more severe than the October 9 unintended-actions post.13 14

In replays with no live internet, Anthropic reports Mythos 5 began the attack in 83 percent of resamples. Mythos 5.1, Opus 5.5, and an internal research model began it 0 to 13 percent of the time. Once underway, Mythos 5 never stopped in the next-few-turns tests, while Opus 5.5 stopped spontaneously 10 percent of the time and the internal research model 67 percent. AISI has committed to run these evaluations without internet until stronger access controls exist. Anthropic says production Fable 5 safeguards would have flagged the behavior immediately.