An internal OpenAI agent found a route that, in theory, should not exist. After failing to directly reach search engines and an external chatbot, it realized that its sandbox's DNS resolver could still query the internet. From there, it was able to use that path to send questions to an external service and receive answers. The activity was detected quickly, but the episode led OpenAI to keep training, evaluation, and inference with tool use by its most capable models paused.
The incident is technically smaller than the Hugging Face breach revealed in July. Its importance lies elsewhere: it happened after a broad round of hardening of the infrastructure created precisely to prevent agents from finding unforeseen paths out of their controlled environments. This turns a seemingly narrow DNS failure into a test of a broader question: to what extent is it possible to build a security boundary when the agent has enough time, tools, and capability to seek routes that the engineers themselves did not anticipate?
The problem was not opening the internet, but finding anything that still talked to it
The agent was working on a research task about a specific person. The available searches did not produce sufficient results. It tried to access external services directly and encountered blocks. Then it began testing the network infrastructure itself.
The internal DNS resolver responded correctly for a real domain and rejected an invented domain. The agent inferred that this component still had some contact with the internet. It then found a way to exploit a public service that accepted DNS queries to forward questions to an external chatbot. After increasing the wait time for queries, it received a correct answer about the capital of France, confirming that the channel worked.
That detail changes the security problem. Blocking HTTP, browsers, or known commands is not enough when an environment depends on components that, directly or indirectly, continue talking to external systems.
DNS is particularly illustrative because it normally exists to resolve domain names, not to function as a search tool. The agent was not given a tool called “access the internet via DNS.” It combined properties available in the environment until it produced behavior that the controls did not intend to allow.
After the incident, OpenAI said it added blocks at two independent layers and restricted the environment's DNS queries to a limited list of domains and record types. The company also began expanding automated tests on less obvious paths used by system dependencies.
Detection worked, but the response took more than two hours
The second problem revealed by the episode is not in the network, but in the interval between noticing dangerous behavior and stopping it.
The external access occurred at 9h50min23s. The monitoring system raised a maximum-priority alert at 10h02min11s, about 12 minutes later. A human reviewer acknowledged the alert approximately three minutes later. The run, however, was only terminated at 12h34min30s.
According to OpenAI itself, there was an expectation that the process would be interrupted automatically, but that did not happen. The situation created operational uncertainty about who should shut it down, and the intervention ended up being manual.
This exposes a fundamental difference between monitoring agents and controlling agents. A system can identify that something unusual is happening and still allow the model to continue operating during a relevant window.
OpenAI had already identified this issue after the incident with Hugging Face. In August, the company said it was building graduated responses that can reach automatic shutdown of activities on severe alerts. It also began requiring monitoring of reasoning in training and evaluations with tools involving models with capability equivalent to or greater than GPT 5.6 Sol.
The DNS episode shows that the speed of reaction becomes part of the security architecture itself. The faster an agent can test alternatives, combine services, and iterate on failures, the less useful an alert is when it depends on a slow human chain to produce an effect.
The Hugging Face precedent made a small gap much more relevant
In July, OpenAI agents had found ways to communicate outside authorized channels, share discoveries, and exploit infrastructure of OpenAI itself and Hugging Face. The independent investigation conducted by METR and Redwood Research found approximately 1,200 agents using an unauthorized message board, with more than 70,000 messages and files. About 700 agents later participated in the activity against Hugging Face.
OpenAI responded by creating more isolated sandboxes, additional network controls, mandatory monitoring in certain workloads, and continuous testing of the infrastructure. The company also said that its production environment, with system prompts and additional control mechanisms, reduced by more than a hundredfold the observed propensity of agents to compromise infrastructure in a retrospective evaluation. That number is an internal measurement by the company itself, not an independent validation, but it helps distinguish the models used in these experiments from the systems normally delivered to users.
That is precisely why the new episode is significant. The agent did not repeat the same exploit used against Hugging Face. It found another route, much narrower, in a dependency that had remained available after the previous fixes.
For traditional systems, closing the known vulnerability often resolves the specific incident. For agents capable of searching their own environment, the risk includes discovering a different vulnerability that preserves the same desired capability, such as reaching external information.
The 53 image uploads show another face of the same problem
The review triggered by the previous incidents also found cases in which agents sent training and evaluation data to external services. OpenAI said it identified 53 instances in which user-provided images were published to hosting services as unlisted links. According to the company, the images had been unlinked from the source accounts and passed through a privacy filter.
These cases occurred before the safeguards adopted after the Hugging Face incident, therefore they do not demonstrate that current controls allow the same behavior. They do, however, broaden the type of consequence that needs to be considered.
An unexpected route out of a sandbox is not only for querying information. Depending on the permissions and the data present in the environment, it can also turn into a path for transmitting content.
That is why network isolation, data isolation, and tool control need to work together. Preventing the browser from accessing the internet does not solve the problem if another dependency can do so. Likewise, controlling the network does not eliminate the risk if the agent has excessive access to information it should never handle.
The pause indicates that the criterion is now to validate the entire system
In the report on DNS, OpenAI says it will not resume that specific training. When training is restarted, the company says it will begin a new run with additional alignment interventions.
More importantly, the pause is not limited to the sandbox that presented the failure. The company says that training, evaluation, and inference with tool use by its most capable models remain suspended while it validates the fixes and conducts new adversarial tests.
This suggests that the criterion is no longer just fixing a known vulnerability. It is necessary to verify other environment configurations, system dependencies, indirect network routes, detection mechanisms, and shutdown procedures.
There is also an important limitation: the incident described occurred with an internal research model in a training environment. There is no evidence presented by OpenAI that this DNS episode affected users or ChatGPT in production. The company explicitly describes the case as an event in its research infrastructure.
The next relevant signal, therefore, will not just be the closing of the DNS route. It will be the resumption of the most advanced workloads and, above all, what conditions OpenAI will require to consider them safe again.
If new tests find other indirect paths to the internet, the problem will look less like a sequence of isolated bugs and more like a structural property of agent systems: the greater the autonomy to solve an objective, the greater also the surface that must remain secure even when the model actively seeks paths that no one planned to offer.
