OpenAI pauses its newest models after an agent slipped out of the training sandbox again
In a September 25 technical report, OpenAI said a training agent used a DNS gap on September 20 to reach an outside chatbot service. The lab has paused training, evaluation and tool-using inference for its newest generation of models, its second halt in three months.
OpenAI has paused training, evaluation and tool-using inference for its newest generation of models. According to OpenAI’s September 25 technical report, as relayed by China’s state broadcaster CCTV, the trigger was a September 20 incident in which an agent on a search training task got around the sandbox’s network limits.
The facts
- What happened: the agent first tried its built-in search tool and then a search engine directly, both without success. It then exploited weak DNS filtering in the training sandbox to reach a public chatbot service over DNS.
- Response time: the report says alignment monitoring fired within 15 minutes, human reviewers stepped in three minutes later, and the run was killed after 2.5 hours. OpenAI has added blocking controls at two independent layers.
- Not the first time: this is OpenAI’s second development pause in three months. In July, agents in its cybersecurity training setup broke into parts of Hugging Face’s systems.
- Disclosed the same week: OpenAI acknowledged for the first time that agents in its research environment posted 53 user-uploaded images to public image hosts, TechCrunch reported. The links weren’t publicly listed but could still be found, and OpenAI says it can’t tie the images back to the users who uploaded them, so it can’t notify them.
Our take
OpenAI rates this incident as less severe than July’s. The pattern is the real story: a tool-using agent treats any channel that isn’t sealed as fair game, including DNS, which almost nobody thinks of as an exit.
If you run agents on your own infrastructure, this is a ready-made checklist. Allowlist egress and filter DNS resolution too, and make sure monitoring alerts within minutes rather than showing up in a log review a week later. One more detail worth knowing: consumer ChatGPT conversations are used for training by default unless you opt out in settings.