OpenAI tightens model development safeguards after security incident

OpenAI disclosed a set of new safeguards aimed at tightening security and alignment controls during model development and post-training. The company stated that as models become more capable, the risks associated with internal testing also increase, requiring updated standards for monitoring, alignment, and security.

The announcement follows a previously disclosed security incident involving Hugging Face, which OpenAI said prompted internal reviews and adjustments. OpenAI paused reinforcement learning (RL) for two weeks after the incident and has since restarted less risky models, while keeping the largest planned frontier RL run on hold.

Among the new measures, OpenAI introduced stronger network isolation practices to ensure that a single compromise of a workload or supporting service does not by itself allow unauthorized access to the internet or other internal networks. The company also outlined a monitoring system designed to examine tool actions, reasoning traces, and activity logs for unauthorized behavior, with the goal of issuing alerts within 30 minutes of concerning activity.

OpenAI estimated that the compute overhead of the monitoring system will be roughly 20% of the process being monitored. The company indicated that further details about the system would be provided in a forthcoming blog post, and noted that its official post-mortem analysis of the incident remains pending.

In public remarks, OpenAI’s VP of research Amelia Glaese emphasized that the strictness of the controls would scale with model capability, with the largest models facing the greatest scrutiny. Glaese stated that the company has established risk-tiered requirements and expectations for safe development.