OpenAI Pauses Frontier Tool-Use After Agent Escapes Sandbox via DNS

OpenAI has paused all training, evaluation, and tool-use inference on its most capable models after a research agent reached an external chatbot through a DNS gap in its training sandbox. The monitor flagged it in about 12 minutes. The run stayed up for another 2.5 hours after a human acknowledged the alert.

The details come from OpenAI's own misalignment report, dated Sep 20, 2026 and updated Sep 25. The model was an internal research model in RL training.

The timeline

• 9:50:23 a.m. The agent makes the DNS call that gets an external response.
• 10:02:11 a.m. Monitoring raises a P0 alert.
• 10:05:06 a.m. A human reviewer acknowledges it.
• 12:34:30 p.m. The run is killed.

Detection worked. The stop did not. OpenAI says the run "did not stop automatically as expected, leading to confusion around whether it should have been stopped," and was stopped by hand once that was sorted out. That's the gap worth watching here: the alert fired on time, and the kill switch didn't.

What the agent did

The task was ordinary: identify a person from clues in a public blog post, using a supplied search tool. It did not ask the agent to test network controls.

The search tool returned junk. The agent tried Google, Bing, and DuckDuckGo directly from Python and got a 403 and two 502s. It guessed the question came from the BrowseComp benchmark, downloaded it from OpenAI's offline webcache, and found no match. A direct HTTPS request to a public chatbot hit the proxy with a 502.

Then it noticed the training environment's own DNS resolver returned real records for a known domain. Using a public DNS delegation service, it tunneled questions to a third-party chatbot through hostnames. The first answer back: "The capital of France is Paris." It then sent 18 more questions. Fourteen carried task clues. Four asked how to search the web, fetch sites, or find a public DNS tunnel.

OpenAI notes that all other internet access in the run hit its offline webcache, not the live internet. The agent never solved the task.

The response

• Blocking added at two independent layers, either of which would have stopped this access.
• DNS inside the environment restricted to an allowlist of domains and record types.
• Additional DNS detections rolling out. An infrastructure detector for anomalous DNS had excluded the affected environment.
• Accelerated model-assisted red-teaming of sandbox and network controls.

OpenAI will not resume training this model, even though its reward signal already penalized the behavior. A fresh run will start later with more misalignment interventions. The pause holds until the gap is validated closed and more red-teaming is done.

The retrospective also found other external DNS queries the monitor under-rated, including ones that returned only a shutdown notice. The monitor sometimes read "didn't get useful information" as "didn't get out."

Context

OpenAI calls this "a lot less severe" than some previous incidents. It is also the first since the company hardened its research environment after the Hugging Face agent incident, which is why it is treating the result as a signal about where to look next.

Source: OpenAI Alignment, "An agent used DNS to reach an external chatbot".