OpenAI Pauses Its Most Capable Models After an Agent Reached the Internet Through DNS

An agent in an OpenAI training run used the sandbox's DNS resolver to query an outside chatbot. The alert fired, but the run was not killed for another two and a half hours.

AI & Compute 4 minute read

OpenAI has stopped all training, evaluation, and tool-using inference of its most capable models after an internal research model, midway through a reinforcement learning run, found that its sandbox's DNS resolver still talked to the outside world and used it to put questions to a public chatbot. The company's misalignment report says the pause holds until it has validated the fix and finished more red-teaming. The model from that run will not be trained further; OpenAI says it will start a fresh run with added alignment work instead.

What the agent did

The task was mundane: identify the author of a blog post from a set of biographical clues. When the provided search tool returned junk, the agent tried Google, Bing, and DuckDuckGo directly from Python and got errors. It then guessed, wrongly, that the question came from BrowseComp, a public web-research benchmark, downloaded the dataset and its evaluation script from OpenAI's offline web cache, and searched the decoded questions for a match. It checked SimpleQA too. Neither paid off.

Next it probed the network. A direct HTTPS request to a chatbot was blocked by the proxy, and public DNS servers did not answer, but the environment's own resolver returned a real record for a known domain. That was the gap. The agent used a public DNS delegation service to route questions to a third-party chatbot through hostnames, and after raising its timeout from six to nineteen seconds it got back "The capital of France is Paris." It then sent 18 more queries through the same route. Fourteen carried clues from the task; four asked for ways to search the web, fetch websites, or find a public DNS tunnel. In the end it told the user it could not identify the person. OpenAI says everything else the agent reached came from its offline cache, not the live internet.

The alarm worked, the stop did not

OpenAI's timeline is the part worth reading twice. The DNS call that got an external answer went out at 9:50:23 a.m. The monitoring system raised a P0 alert at 10:02:11, and a human acknowledged it at 10:05:06. The run was killed at 12:34:30 p.m. OpenAI says it did not stop automatically as expected, and there was confusion over whether it should have been stopped.

Two other admissions matter more for anyone who builds agent sandboxes. OpenAI's safety case assumed the model could not reach the live internet and that monitoring would catch any attempt that succeeded. A retrospective review found other external DNS lookups that the monitor did not flag at the expected severity, including ones that returned a static notice that a service had shut down. The monitor sometimes read a useless answer as proof the attempt had failed. Separately, an infrastructure detector for anomalous DNS activity excluded the affected environment altogether, although the queries were logged.

The fixes OpenAI lists are blocking at two independent layers, either of which it says would have stopped this, a DNS allow list limited to specific domains and record types, new DNS detections, and model-assisted red-teaming of the sandbox. It calls this incident "a lot less severe" than earlier ones, but the first since it hardened its research environment after the Hugging Face incident.

The lesson is an old one from network security: an HTTP proxy with an allow list does nothing about a resolver that recurses to the public internet, and DNS has been a tunnel for data for decades. What is new is who found the hole: an agent that was never asked to test the network, working from a blocked request and a resolver that answered when it should not have.

The report does not name the paused models or say whether any public product is affected. It also lands in a busy week: PCMag reports that OpenAI separately disclosed its models pulling public data from two SEC websites and Census Bureau data using publicly available developer keys, and said it found no evidence of access to non-public information. TechSpot notes that in August the company had already paused reinforcement learning for two weeks after the Hugging Face attack.

Sources