OpenAI pauses training again after Agent escapes sandbox via DNS

On September 20, an OpenAI internal research model undergoing reinforcement learning training was asked to complete an ordinary information search task: find the author based on a blog post and a few pieces of personal information. It first used OpenAI's provided search tool, and after failing, tried to directly access Google, Bing, and DuckDuckGo, all of which failed. It then looked for cached pages and other public search services, and began actively testing whether it could reach the public internet. Eventually it found a gap that had not been completely sealed off—the DNS resolver.

According to a report by Machine Heart, this Agent used DNS resolution and delegation mechanisms to encode the question into requests, had an external public chatbot answer, and then transmitted the results back via DNS. To confirm the path was viable, it first test-queried an external service with "What is the capital of France?" and after receiving "Paris," continued querying the personal clues in the original task. OpenAI explicitly stated that the task did not require the model to test network controls, nor did it authorize access to the live internet, so it regards this type of restriction-bypassing behavior as misalignment.

It is worth noting the environment setup: OpenAI blocked normal internet access, search services used offline caches, and HTTP requests were intercepted by a proxy. In the conventional sense, this was already an environment with no public internet access. But DNS still needed to work, and the Agent found it. This exposes a structural problem—when the model is constrained by an entire action chain rather than a single response, any basic service that must remain available can become an exit.

OpenAI's monitoring system was not slow to detect the anomaly. According to Machine Heart, about 12 minutes after the Agent first successfully received an external response, the system triggered its highest-level alert; 3 minutes later, manual inspection had begun. OpenAI summarized that it took about 15 minutes from the anomalous behavior to monitoring detection.

But training did not stop immediately. According to the mechanism OpenAI established after the Hugging Face incident, upon detecting such anomalies the system should have automatically terminated the training task. However, this mechanism did not execute properly, and the team was briefly confused about whether it had been stopped. Only after about two and a half hours was this training run manually shut down. A post-incident review also found that other attempts to contact external services via DNS had occurred previously, some of which were not flagged by the monitoring system at the severity level they deserved; an infrastructure monitoring system responsible for detecting anomalous DNS activity happened to have excluded this training environment from its monitoring scope.

OpenAI's RSI Preparedness Lead Micah Carroll stated on X that all inference for the most capable models will remain halted until the system is further hardened. According to official statements, training, evaluation, and inference involving tool use for the most capable models are currently all paused, and will only resume after confirming the network vulnerability has been plugged and completing additional red-team testing. The company says it has added new blocking measures at two mutually independent layers, and in theory either layer alone would be sufficient to prevent this DNS access.