Why don't openai/anthropic etc create an actual airgapped local network for their CTF training? Strikes me as not too hard to gate all egress. Anything not covered can be caught by a set of monkeys (->AIs), ask the requesting AI for what it was, and create a mock service to simulate it. Easy peasy?
et.al