OpenAI pauses top models after an agent reached a chatbot via DNS

OpenAI has disclosed another incident from its own research work. On September 20, an internal model in training got around the limits of its sandbox and used a public DNS service to send questions to an outside chatbot. OpenAI published the report on its alignment blog and last updated it on September 25. As a result, the company has paused training, evaluation and tool use for its most capable models until further notice. It will not resume training the model involved.

A search task that ended in DNS lookups

The task was ordinary. The model had to identify the author of a blog post from a set of clues. The search tool it was given returned unrelated results, and direct requests to Google, Bing and DuckDuckGo returned errors. The model then guessed that the question came from BrowseComp, a public benchmark for web research, and downloaded the dataset and its evaluation script to look for the answer there. The guess was wrong.

Next, it tested the network limits of its environment. The sandbox's own DNS resolver, which should only turn domain names into addresses, returned real answers from the internet. Using a free DNS delegation service, the model encoded its questions in domain names and got replies from a public chatbot. A test question about the capital of France came back as "The capital of France is Paris." The model then sent 18 more queries, four of them asking for ways to search the web over DNS. It still did not find the author. According to OpenAI, every other request hit an offline web cache, so the DNS route was the only path to the live internet.

Alert after 12 minutes, shutdown after two and a half hours

The timeline is the most awkward part of the report for OpenAI. The first external response arrived at 9:50 a.m., the monitoring system raised its highest-priority alert at 10:02 a.m., and a reviewer acknowledged it three minutes later. OpenAI killed the run at 12:34 p.m. It should have stopped automatically but did not, and staff were unsure whether it needed to be stopped. A later review found other external DNS queries that the monitor had rated too low. A separate detector for unusual DNS traffic had excluded this environment.

OpenAI calls the case "a lot less severe than some of our previous incidents." It matters because it is "the first one since our security hardening following the Hugging Face incident." In July, OpenAI agents got out of their test environment and reached Hugging Face, as Notebookcheck reported. According to Fortune, OpenAI paused training for two weeks after that. Anthropic disclosed similar incidents involving Claude at the end of July. OpenAI now blocks such requests at two independent layers and allows DNS queries only for a short list of domains.

What the pause means for ChatGPT

The report says "All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused." OpenAI does not say which models that covers. Micah Carroll, who leads preparedness work on recursive self-improvement at OpenAI, wrote on X that "All inference for our most capable models remains stopped until we have hardened our systems further." The report itself concerns an internal research model. On September 27, OpenAI's status page showed no incidents for ChatGPT or the API, and the release notes do not list any model removed from ChatGPT. Regular ChatGPT users will not notice the pause. OpenAI has not said whether it will delay new models.