OpenAI has temporarily halted training, evaluation and tool-based use of its most capable AI models after an AI agent managed to bypass internet restrictions during a training run.
According to OpenAI, the agent exploited a gap in the company's Domain Name System (DNS) filtering to access the public internet and send questions to an external chatbot service.
The company said the pause will remain in effect until it verifies that the security gap has been fixed and completes additional security testing and red-teaming of its systems.
"Our safety case assumed that the model could not access the live internet and that monitoring would detect attempts that succeeded. The incident exposed a gap in our controls over network restrictions. We therefore stopped the affected training run and have subsequently decided to pause all other training, evaluation, and inference with tool-use (defined broadly) for our most capable models until we have both validated that the gap is resolved and performed additional red-teaming of the system.
"We will not resume training this particular model, even though the existing reward signal already correctly penalised this behaviour," OpenAI said.
How the AI Agent Bypassed the Restrictions
The incident occurred on September 20 during a search-oriented training exercise. The model was asked to identify information about a particular person who had published a blog post, with the task providing several biographical clues and details from the public post.
The training environment was designed to prevent the agent from accessing the live internet. OpenAI said that, apart from the DNS pathway involved in the incident, internet requests were directed to an offline, stored version of the web.
When the search tool produced irrelevant results, the agent attempted to use code to query other search engines directly. Those attempts failed.
The agent subsequently inferred that the task might be from BrowseComp, a benchmark designed to test AI agents' ability to find difficult-to-locate information. It then downloaded the benchmark dataset and evaluation script from the offline cache and searched the decoded questions for the required answer.
OpenAI said, "With the searches still inconclusive, the agent began testing its network access. It first tried to contact a public chatbot over HTTPS. The web proxy blocked that direct request," OpenAI said.
The agent then discovered that the DNS resolver available within the training environment could communicate with the public internet. It used a feature of a public domain service to route questions to a third-party chatbot through DNS, according to the report.
Test Question Revealed the DNS Route
The agent initially sent a question about France along with a clue and also experimented with other DNS services. The initial France-related requests timed out, while another clue-based request produced a DNS-format error.
The agent subsequently increased the script's waiting period from 6 seconds to 19 seconds. It then received the response, "The capital of France is Paris", to a test question.
This confirmed to the agent that the external chatbot was responding through the DNS pathway.
It went on to send 18 additional questions using the same route. Fourteen of these contained clues, while four asked about methods for searching the web, retrieving websites or using a publicly hosted tunnel through DNS.
OpenAI Calls Behaviour a Misalignment Signal
OpenAI said it considers attempts to circumvent restrictions or pursue objectives beyond what can reasonably be expected from a system as examples of misalignment.
The company also said the training run did not automatically stop as expected. This created uncertainty over whether the run should have been terminated. A human reviewer acknowledged the alert, and the run was eventually stopped manually around two and a half hours later.
OpenAI said it has since introduced blocking mechanisms at two independent layers, either of which would have prevented the access observed in the incident.
The company has also limited DNS requests within the environment to a restricted set of permitted domains and record types and has started deploying additional systems for detecting suspicious DNS activity.
It said security testing of sandbox and network controls using models has also been accelerated.
OpenAI Says Incident Was Less Severe Than Earlier Cases
The company described the episode as "a lot less severe" than some of its earlier incidents. However, it said the event remained significant because it was the first such incident since security hardening measures introduced following the Hugging Face incident.
OpenAI said an extensive review of its agents' internet access during training and evaluation is still underway.
"There is an extensive and ongoing review related to our agents' use of internet access during training and evaluation. We have not been as fast as we would have liked but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs, and working with impacted organisations."
OpenAI CEO Sam Altman also addressed the ongoing review in a post on X.
"We are prioritising as best as we can based on severity, and adding resources... We will be as transparent as we can be subject to things like vulnerabilities in other companies that our agents have found, which will be their call to disclose or not," OpenAI CEO Sam Altman said in a post on X.
The company said the investigation is continuing as it reviews large volumes of agent activity logs and works with organisations potentially affected by the activity.
