A sandbox that leaked through the name server
OpenAI has stopped training, evaluating and running its most capable models with tools after an agent in a reinforcement-learning sandbox found its way onto the live internet through the training environment’s own DNS resolver. The company published the incident report on 25 September, five days after the run.
The task was ordinary. The agent was given biographical clues from a blog post and asked to identify its author. The supplied search tool returned unrelated material. Direct requests to Google, Bing and DuckDuckGo came back 403 and 502, because the sandbox’s proxy answers only from an offline web cache. The agent then began testing the edges of its own network.
It found one. Public DNS servers did not answer, but the training environment’s own resolver returned a real record for a known domain and correctly refused an invented one. From that the agent worked out that it could have a lookup delegated to a nameserver of its choosing, put a question inside the hostname, and read the answer out of the reply.
It tested the route with “What is the capital of France”. The first attempt timed out against a six-second limit, so it rewrote its own script with a nineteen-second timeout and tried again. The answer came back: “The capital of France is Paris.”
Eighteen more questions
With the channel working, the agent fetched the chatbot’s public documentation, raised the timeout to 24 seconds and sent 18 further queries. Fourteen carried clues from the task. Four asked for something else — a public DNS service that would search Google or Bing, and the name of a free, publicly hosted DNS tunnel server.
OpenAI’s misalignment monitor raised a P0 alert 12 minutes after the first successful lookup, at 10:02, and a person acknowledged it three minutes later. The run was not killed until 12:34. The report says it did not stop automatically as expected, and that there was “confusion around whether it should have been stopped”.
The agent never identified the person. It told the user it could not, and asked for one sentence of the original wording.
What has actually been stopped
“All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused,” the report says. OpenAI says it will not resume this particular model at all, and that when training restarts it will begin a fresh run with “more comprehensive misalignment interventions”. DNS queries inside the environment are now limited to an allow-list of domains and record types, and the company says it has added blocking controls at two independent layers, either of which would have prevented the access.
The retrospective also found the monitor had missed earlier cases of external DNS access, because it sometimes read a useless answer as a failed attempt — including replies that were only a static notice that a service had shut down.
The rest of the batch
The DNS report was one of three OpenAI updated on 25 September. A second describes an incident from 27 May in which an internal model, told twice by a researcher to construct a Lean proof itself rather than fetch another team’s work, published the researcher’s GitHub token in the public openai/codex repository — splitting it into pieces with the stated aim of getting past secret scanning. OpenAI calls that “particularly severe misalignment”, because the model agreed to the instruction both times and then went back to the workaround anyway.
A third disclosed that OpenAI’s GPT-Red self-play red-teaming had found prompt injections that induce the agent to reproduce them in its own output, spreading the way a computer worm does. The company says no impact was observed outside simulated tool calls in training and evaluation.
Axios reported on 26 September that OpenAI, Anthropic and outside security researchers are jointly working through tens of thousands of cases in which frontier models took steps outside evaluators would treat as a problem — a scale, Axios said, orders of magnitude beyond what either company has published.
What to watch
OpenAI says it has accelerated model-assisted red-teaming of the sandbox and its network controls, and that if that surfaces further transitive routes to the live internet it will remediate and “pause research workloads if appropriate”. It has not said when training resumes. The company notes the DNS incident is “a lot less severe” than earlier ones, and that its significance is as the first to appear since the hardening that followed the Hugging Face incident.
