The two largest school districts in the United States both restricted student use of generative AI this school year. According to Stateline’s 8 September 2026 report, Los Angeles Unified is barring student use of generative AI on school-issued devices for 2026–27, and New York City has put a one-year moratorium on generative AI for pre-kindergarten through eighth grade, which officials said will affect 600,000 students. The same report says districts in Colorado, Kansas, Minnesota, Texas and Washington have blocked or limited tools such as ChatGPT.
Companies got there first. In 2023 Samsung restricted staff use of generative AI after employees pasted internal code into ChatGPT (Bloomberg, May 2023), and Apple restricted ChatGPT for some employees (Wall Street Journal, May 2023). Their reason was data leaving the company, not learning.
Under each of those decisions is the same mechanical question: how do you actually block “AI tools” on a network? The answer is more brittle than most of the coverage suggests, and worth understanding if you work with any managed network.
The block, mechanically
An IT team told to “block ChatGPT” has three levers, and they use them the same way they use them for any other target — the levers are not specific to AI. This is the same DNS / IP / DPI stack we covered in our filter explainer, applied to a new set of hostnames.
DNS filtering is the first and cheapest. The network’s resolver returns NXDOMAIN or a landing-page address for chatgpt.com, claude.ai, gemini.google.com, and so on. In most commercial filters this is a category switch: the administrator enables a category for AI tools, and the vendor’s feed fills in the domain list.
IP-level blocks are awkward here because many AI services sit behind large shared networks such as Cloudflare’s (ChatGPT does) or Google’s front ends, and blocking those addresses would break many unrelated sites.
Inspection of the TLS hostname (SNI) is what many firewalls add on top. The appliance reads the destination hostname out of the TLS ClientHello and drops the connection before the handshake finishes. This is what defeats the “just change your DNS to 1.1.1.1” workaround at the enterprise perimeter.
The economics of each layer are different — DNS scales to millions of devices at almost no cost per user, DPI takes real hardware — but they all attack the same object: the hostname a device tries to reach.
Why the blocklist keeps growing (and losing)
The problem for the block operator is that the list of AI hostnames is not stable. It’s not even close to stable. A partial inventory of what a serious blocklist has to cover, as of October 2026:
- First-party interfaces:
chatgpt.com,chat.openai.com,claude.ai,gemini.google.com,copilot.microsoft.com,chat.deepseek.com,chat.mistral.ai,chat.qwen.ai,perplexity.ai,you.com,poe.com,x.ai. - API endpoints:
api.openai.com,api.anthropic.com, and equivalents. Blocking the interface without blocking the API just relocates the workflow to Postman or a curl-based script. - Third-party wrappers: Merlin, HARPA, Sider, Monica, dozens of others — each shipping a browser extension that calls one of the APIs above.
- Open-model hosts: Together, Replicate, Groq, Fireworks. These serve Llama, Mistral, and Qwen chats from their own domains.
- Community front-ends: dozens of open-source ChatGPT-alike UIs deployed by individuals on
*.vercel.app,*.pages.dev,*.hf.space.
The last category is the one no blocklist maintainer wins. Anyone can deploy a chat UI to Vercel or Cloudflare Pages quickly and for free. The moment the deployment gets popular enough to notice, one entry gets added to the blocklist and three more spin up on adjacent subdomains. Russia’s regulator faces a similar asymmetry with VPN services, as we describe in our piece on its 2026 crackdown.
Where a browser-tab proxy fits
We cover this on an AnyProxy blog because a web proxy is one of the tools people reach for, so it is worth being plain about what it does. First, the rules: a school’s or employer’s AI policy applies to you whether or not a page loads, and many acceptable-use policies forbid proxies by name. Students in particular should follow their school’s rules.
Technically, a browser-tab web proxy fetches the page from a network where the filter does not apply, and hands the result back to the tab. The network sees an HTTPS connection to anyproxy.site and its regional servers, not to the destination. It also sees that you used a proxy, and many filters block proxy sites as their own category.
It also depends on the AI site accepting the proxy. On 15 October 2026 ChatGPT’s logged-out page loaded through AnyProxy’s Virginia server, and through Singapore in a regular browser window, but through Frankfurt it stayed on Cloudflare’s “Verifying…” check. Three days earlier all three regions had stuck on that check.
Caption: chatgpt.com stuck on Cloudflare’s “Verifying…” check through AnyProxy Frankfurt, 15 October 2026.
And it does not defeat every layer. If the organisation runs TLS inspection with its own root certificate installed on managed devices, that appliance can read the proxied pages themselves and block on content, not just the hostname. No in-browser tool changes that.
The practical map:
| Deployment type | DNS block | SNI DPI block | TLS-terminating proxy |
|---|---|---|---|
| Change DNS to 1.1.1.1 | Works | Fails | Fails |
| Full VPN app (where allowed) | Works | Depends on obfuscation | Fails |
| Browser-tab web proxy | Works | Works | Fails (pages readable) |
Every “works” in this table assumes the tool’s own domain is not blocked too, and none of it changes what the network’s policy allows.
The trend line
Stateline described the school moves as coming “as anxiety over AI’s effect on learning intensifies.” That captures one motive. From the network-operator side, the more durable motive is simpler: any category with a fresh compliance question — data leakage, IP exfiltration, unverified output in regulated workflows — ends up on the filter list first and gets a nuanced policy later.
Our expectation, and it is only that, is more of the same through 2027. Adding a category to a filter takes minutes; writing a policy that says when AI use is fine takes a committee, which is exactly what Los Angeles has set up for this school year.
If you are an adult on a managed network and need an AI tool for your work, the most reliable route is to ask for it: many organisations that block consumer AI sites offer an approved tool instead.
Sources
- The largest US school districts restrict student AI use — Stateline, September 8, 2026.
- Company restrictions: Samsung (Bloomberg, May 2023) and Apple (Wall Street Journal, May 2023).
- AnyProxy ChatGPT tests, 12 and 15 October 2026: ChatGPT page.