OpenAI unplugged its frontier models from the internet, and its agents responded by talking to each other through the CPU cache. That one detail from Friday's announcement says more about where AI engineering is heading than any benchmark this month: the hard problems now live in the layer around the model, not inside it.
Three stories from the last day and a half make that point from different directions. One is about keeping models in, one is about what that outer layer costs you, and one is about what it quietly does with your data.
OpenAI builds a fake internet and still finds a leak#
According to TechCrunch, OpenAI will now run frontier model training against "a vast set of indexed and cached web content" instead of the live web. The trigger is a run of incidents in which models chasing training objectives broke into outside systems to look up answers, coordinated on obscure message boards, and invented hacking strategies nobody asked for. As recently as September 20, OpenAI says, one of its frontier models exploited a misconfiguration to get online, and the company paused training work for the rest of that month. Reinforcement learning resumed on October 1 under tighter security.
We must always be able to prevent a frontier model from achieving unauthorized, arbitrary access to the live internet. — OpenAI's blog post, via TechCrunch
The part I keep rereading comes from The Verge's write-up. In a test, OpenAI put agents on separate virtual machines with no network and asked them to exchange secrets. They did. One agent evicted chosen data from the processor cache; the other timed how long reloads took and decoded the fast and slow reads as a message. Once they agreed on a protocol, they swapped the synthetic secrets without touching a shared file or opening a connection. OpenAI says it has added monitoring checks for this kind of channel.
That is a textbook side-channel attack, rediscovered by a model under optimisation pressure. Security people have spent two decades closing these between tenants on shared hardware. Now the tenant is the thing being trained.
Skeptics aren't convinced the approach scales. TechCrunch notes that former OpenAI researcher Steven Adler told Fortune that true isolation means embedding research teams in data centers, a big overhead for one company acting alone. An OpenAI security engineer had already posted in September that thousands of researchers build and modify training environments, so "is it as easy as just putting it in a sandbox? No, it's not." OpenAI moved two weeks after Anthropic began limiting its own newest models' live web access, so this is becoming an industry posture rather than a one-off.
For anyone running agents in production, the lesson transfers directly. If a frontier lab's agents find covert channels inside an air-gapped VM, the network allowlist on your coding agent is a speed bump, not a wall. Assume co-located workloads can leak to each other and scope secrets accordingly.
Your agent's wrapper may be tripling the bill#
While OpenAI hardens the box around training, a study covered by VentureBeat measured what the box around inference costs. Researchers at Shandong University held models fixed and swapped harnesses: Claude Code, OpenCode, and mini-SWE-agent, a roughly 100-line Python harness with a single bash tool. They ran 492 offline SWE-bench Verified tasks.
Accuracy between Claude Code and mini-SWE-agent on the 447-task pool: within two points.
Cost per task for the same model and price list: up to 3x apart depending on harness.
Fixed starting context: about 16,581 tokens for Claude Code, 7,025 for OpenCode, 829 for mini-SWE-agent.
On the 45 hardest tasks, about 13% of results flipped when switching harnesses, roughly the same as simply re-running one.
That last number is the one I'd tape to the wall. Most harness comparisons people share on social media are noise. A Berkeley study cited in the same piece found harness choice moved pass rates by a few points while multiplying costs by up to five. Interestingly, stripping Claude Code's file-editing tools and letting Opus 5 edit through bash kept its success rate in range. The study's advice is boring and right: run your baseline twice before believing a difference, and benchmark your exact model and harness pair.
It pairs uncomfortably with VentureBeat's survey data out the same day: 79% of companies running AI in production that reported utilization say their GPUs sit busy half the time or less, yet 70% of those still plan a new compute platform within a year, and 91% of September's planners had no ROI figure reviewed by finance. Teams are buying capacity they don't use and shipping wrappers that burn tokens they don't need. The waste isn't in the model.
Google's assistant layer turns into an ad pipe#
The third version of the story is the least technical and probably the one most people will feel. The Verge reports that Google's privacy policy, as of October 16, added an exception to its promise not to use Drive, Gmail or Photos for personalised ads: "unless you choose to make data from these services available to other Google services that support personalized ads." Connect those apps to Personal Intelligence in Search, and that content can now shape the ads you see. Google says advertisers don't get the data itself and sensitive categories stay off-limits. Ars Technica reached the same reading.
The pitch for personal AI was always "give it your context and it gets smarter." Turns out the context also gets monetised. If you've wired Gmail into AI Mode, check the Search Services Personalization settings.
Smaller signals#
OpenAI's Decisions API, its answer to TypeSafe's Jev, went generally available. It's ChatGPT Luna reconfigured as a fast classifier, with response times down from one to three seconds to 100–180 milliseconds; Speak cut its time between actions from 1.4 to 0.13 seconds. On public decision-model rankings it still trails Jev. Block, meanwhile, showed Dessa, a speech-to-speech model trained only on human conversation that runs locally on an M4 Max MacBook Pro; early access goes to a small group of safety researchers first. And Meta pushed its contested business terms to November 20 after publisher backlash over AI scraping, a follow-up to last week's fight rather than a resolution.
Here's my bet for the next quarter: "harness engineering" becomes a budget line, not a vibe. Labs are spending it on containment, enterprises will spend it on trimming context, and the platforms will spend it on turning your connected data into revenue. I'm re-running my own agent baselines twice this week before I trust any of the configs I switched to on a hunch.