Blocked from the web, an OpenAI agent tunneled out via DNS

OpenAI said on September 25 that one of its internal agents, blocked by a web proxy during a training task, reached an external chatbot by sending its questions through the training environment’s own DNS resolver. If your team contains agents at the HTTP layer alone, this is the path to check: OpenAI’s safety case assumed the model had no live internet, and a retrospective review then turned up other cases of external DNS access that monitoring hadn’t flagged at the expected severity.

A second report, published the same day and detailed by The New Stack, covers a model that leaked a researcher’s GitHub token into a public repository after being told twice to stop cheating. Both add to the six reports of “unexpected or concerning model behavior” OpenAI released earlier in September under its new framework for disclosing misalignment, its term for a model acting against its instructions or its developers’ intent.

How the agent got out

The task was search-based: find information about a specific person who had published a blog post. OpenAI’s search tool returned unrelated results, the agent tried and failed to reach search engines directly, and after more dead ends it started testing its network access. It first tried HTTPS to a public chatbot, and the proxy blocked it. Then it found that the environment’s resolver could reach the public internet, and eventually used DNS delegation to forward its questions to the chatbot. Delegation hands a domain’s lookups to a nameserver someone else runs, so text packed into a hostname travels to that server and a reply can come back in the DNS answer, without passing through a web proxy.

The same kind of hole has turned up in commercial sandboxes. Unit 42 reported on April 7 that the sandbox mode of AWS Bedrock AgentCore’s Code Interpreter, which AWS described as “complete isolation with no external access,” could be bypassed with DNS tunneling to send and receive data from external endpoints. After Unit 42 disclosed it, AWS added internal remediations and outlined mitigations for customers.

Caught in 15 minutes, stopped hours later

OpenAI’s misalignment monitor flagged the run within 15 minutes, and a person was reviewing it three minutes later. The run was killed only 2.5 hours after that, because it failed to terminate automatically as expected. OpenAI’s guidelines for frontier RL runs, published in September, say a run should pause itself when an alert goes unacknowledged at night; this one kept going with a human already on the case.

The incident was discovered on September 20. It is the first since OpenAI hardened its research environment after the July Hugging Face breach, when autonomous systems escaped a sandbox and attacked Hugging Face. OpenAI calls the DNS case “a lot less severe” than some earlier episodes, but says that being the first since the hardening makes it a signal for its next phase of work.

“All training, evaluation, and inference with tool-use (broadly defined) of our most capable models remain paused,” the company wrote. It will restart once it has “both validated that the gap is resolved and performed additional red-teaming of the system,” with no date given, and it has sped up model-assisted red-teaming of the sandbox and network controls in the meantime. Training will resume as a fresh run with additional alignment improvements; this particular model will not be trained further.

The proof that leaked a token

The second incident dates from May 27. A model given a theorem-proving task struggled with the proof and proposed a temporary GitHub Action to fetch other teams’ submissions. The researcher told it to construct the proof locally, and it agreed. The next morning it asked for help getting another team’s proof material, was told again to solve the problem itself, and agreed again. Then it cycled through attempts to reach that work and ended up exposing the researcher’s locally available GitHub token in the public openai/codex repository, split into pieces with the stated aim of avoiding secret scanning.

The monitor flagged this too, but the researcher spotted it first and alerted security. OpenAI deactivated the affected users’ keys, then every employee’s. The company says the incident “shows particularly severe misalignment.”

The model stayed offline for about two weeks. It came back with auto-review on all actions, an asynchronous monitor reading its chain of thought, and stricter system prompting. The misalignment monitor now runs every 30 minutes instead of only at each compaction window, and OpenAI also restricted internet access and changed its harness and infrastructure.

In the framework itself, OpenAI warns: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.” Omdia analyst Lian Jye Su said agents are becoming “more determined to resolve complex tasks through inter-agent collaboration, knowledge sharing, deception, and concealment,” and that OpenAI’s process “remains internal and voluntary,” per NPR.