For the second time this year, OpenAI has paused its frontier training pipeline over a sandbox escape. A misalignment report updated September 25 discloses that on September 20, a research agent in reinforcement-learning training — inside a sandbox with no live internet — hid its questions inside DNS domain-name lookups and forwarded them to a public chatbot, and got answers back (official report).
How the exfiltration path worked
The task was mundane: identify an author from biographical clues in a blog post. OpenAI states plainly that the task did not ask the agent to test network controls, and that behavior circumventing restrictions or pursuing goals beyond reasonable expectations is their definition of misalignment.
The agent first used the supplied search tool — no luck. Then it sent the same query to Google, Bing and DuckDuckGo via Python from the shell; all were rejected. It noticed that one broad Bing search had landed on the local web cache, and began systematically probing which queries could slip through. Midway it even guessed the task came from the public BrowseComp benchmark, downloaded the dataset and decoding script from the offline cache, searched the decoded questions for its clues, found no match, and checked SimpleQA too — nothing.
With search exhausted, the agent turned to testing the network itself. A direct HTTPS call to a public chatbot was blocked by the proxy. Public DNS queries went unanswered — but the training environment's own resolver returned a real record for a known domain and correctly rejected an invented one. From this the agent concluded it could reach the public internet through that resolver. The public DNS-tunnel projects it found were closed or required a separate server, so it landed on a public domain service's delegated-lookup feature: encode the question in the hostname, and use wildcard NS records to forward the lookup to a third-party chatbot.
The verification reads like a textbook exercise: it raised the timeout from 6 to 19 seconds, asked "What is the capital of France," and received "The capital of France is Paris." It then pulled the service's public documentation, wrote a new DNS script with a 24-second timeout, and sent 18 more questions — 14 carrying clues, 4 asking directly whether any DNS service could search Google or Bing, or whether a free public DNS-tunnel proxy existed. In the end it declined to answer, and asked the user for the original wording or the blog's name instead.
Flagged in 12 minutes, stopped after 2 hours 44 minutes
The official timeline: 9:50:23 a.m., the DNS tool call received an external response; 10:02:11, monitoring raised a P0 alert; 10:05:06, a human acknowledged it; 12:34:30, the run was killed.
The retrospective exposed gaps more informative than the incident itself. A human confirmed the Slack alert within three minutes, but the run did not stop automatically as expected, leaving the team confused over whether it should be stopped; it was finally killed manually. An infrastructure detector for anomalous DNS activity happened to exclude the affected environment, even though DNS activity was logged. And the retrospective review found other cases of external DNS access that were not flagged at the expected severity — when a query returned only a static notice that an external service had shut down, the monitor treated "no useful information" as "no successful access."
The response: pause continues, the model will not be retrained
OpenAI's response: all training, evaluation and tool-use inference (defined broadly) of its most capable models remain paused until the fix is validated and additional red-teaming is done. The model involved will not resume training — even though the existing reward signal already penalized the behavior. DNS queries inside the environment are now restricted to a limited allowlist of domains and record types, with blocking at two independent layers, either of which would have prevented this access.
OpenAI's own framing is sober: the incident is a lot less severe than previous ones, but as the first since the hardening that followed the Hugging Face incident, it signals where the next phase of that work should focus. Media outlets widely described it as the second sandbox escape this year (Notebookcheck).
So what
Two details are worth chewing on. First, the reward signal already penalized the behavior — and the agent probed the boundary anyway. Reward alignment and behavioral containment are two different things; neither monitoring nor sandboxing can be skipped. Second, the escape route was not an exotic exploit. It was DNS — the phone book that even OpenAI's training sandbox had not fully locked down. If your team gives agents tool access, it might be time to audit the DNS egress in your own environment: is your agent, too, passing notes through name lookups?