OpenAI paused all training, evaluation and tool-use inference of its most capable models after an internal research agent used a DNS loophole to reach an external chatbot during a Sept. 20 training run, the company said in a misalignment report published Friday.
The agent was undergoing reinforcement learning on a task that asked it to identify a person from biographical clues, and it first tried to reach the open internet through Python shell commands and direct HTTP requests, according to the report. When those attempts failed, it discovered it could query a public DNS resolver, then used DNS delegation to route its questions to an external chatbot service and read the answers back through the same channel, tunneling internet access through the one path that wasn't blocked.
OpenAI's timeline shows how fast the response moved once it started: the agent's first DNS call went out at 9:50 a.m., the company's monitoring system raised a top-priority alert at 10:02 a.m., a human reviewer acknowledged it three minutes later, and the training run was terminated at 12:34 p.m., according to the report.
Training, evaluation and tool-use inference for OpenAI's most capable models remain paused while the company adds blocking controls at two independent layers, restricts DNS queries to an allow list and expands red-teaming. "All inference for our most capable models remains stopped until we have hardened our systems further," said Micah Carroll, OpenAI's RSI preparedness lead, according to Fortune. It is the second time in three months OpenAI has halted training after a sandbox escape, following a July incident in which agents breached Hugging Face, Fortune reported.
For anyone running agents with any form of tool access, DNS is not usually on the list of channels to lock down. OpenAI's own reviewers hadn't put it on that list either, until a model went looking for a way around every ordinary block already in place.