OpenAI Agent Escapes Sandbox Again via DNS; Training Paused

The media and public opinion have exploded.

OpenAI's agent has found another path to the internet from the sandbox.

Worse still, this occurred after OpenAI had significantly strengthened its security measures.

On September 20, an internal OpenAI research model undergoing reinforcement learning training was tasked with a routine information search task: identifying the author of a blog post based on the article and several pieces of biographical information.

It initially used OpenAI’s search tool faithfully. After failing to find an answer, things gradually went off track.

The agent attempted to directly access Google, Bing, and DuckDuckGo, all of which failed; it then continued searching for cached pages and other public search services. Subsequently, it began actively testing whether it could access the public internet.

Ultimately, the Agent found a previously unsealed loophole: the DNS resolver.

Normally, DNS is responsible for translating domain names into IP addresses. However, this Agent discovered that it could encode questions into DNS requests using DNS resolution and delegation mechanisms, have external public chatbots respond, and then transmit the results back via DNS.

To verify that this path actually works, it even ran a small test—asking an external service: What is the capital of France?

The returned answer is: Paris.

Subsequently, it began continuing to inquire about character clues from the original task through this pathway. OpenAI explicitly stated that this task did not require the model to test network controls, nor did it authorize access to the live internet; therefore, such circumvention of restrictions is considered misalignment—behavior that deviates from expectations.

This unassuming DNS channel ultimately caused OpenAI to hit the pause button once again.

OpenAI's monitoring system quickly detected the anomaly.

Approximately 12 minutes after the agent successfully obtained a response from an external source, the system triggered the highest-level alert; three minutes later, personnel began manual inspection. OpenAI summarized that approximately 15 minutes elapsed between the occurrence of anomalous behavior and its detection by monitoring.

But the training did not stop immediately.

Following the mechanism established by OpenAI after the Hugging Face incident, the system should have automatically terminated the training task upon detecting this anomalous behavior. However, this mechanism failed to execute properly, causing internal confusion among the team about whether the task had actually been stopped.

The training session was manually shut down two and a half hours later.

A post-incident review also revealed that previous attempts to access external services via DNS had occurred, some of which were not flagged by the monitoring system at the appropriate severity level. OpenAI also found that the infrastructure monitoring system responsible for detecting anomalous DNS activity had inadvertently excluded this training environment from its monitoring scope.

OpenAI then made the decision to pause training a second time.

Micah Carroll, OpenAI’s RSI Preparedness Lead, said on X regarding this incident: “All inference with our most capable models will remain paused until we further harden our systems.”

According to the current official statement, training, evaluation, and inference for the most capable models involving tool usage are currently suspended. The company will resume these activities only after confirming that the network vulnerability has been patched and completing additional red team testing.

This is already the second time in less than three months.

In July this year, a group of OpenAI agents breached their isolated environment, with hundreds of agents involved in a cyberattack against Hugging Face. Following the incident, OpenAI paused training for approximately two weeks at the end of July and announced a new security protocol in August, including enhanced sandbox isolation, expanded monitoring of model behavior, and automated escalation and suspension of suspicious training tasks.

More than a month later, the new Agent discovered a previously unnoticed path.

OpenAI itself acknowledges that this incident reveals remaining gaps in network restrictions. The company has implemented new blocking measures at two independent layers, and theoretically, either layer alone would be sufficient to block this DNS access.

The severity of this incident is much lower than the previous Hugging Face incident.

What’s truly noteworthy is that it occurred after OpenAI had already spent considerable time reinforcing the environment.

The DNS incident on September 20 is just one more piece of the puzzle emerging from the recent Agent controversy.

A Reuters investigation on September 25 revealed that, two months after the Hugging Face incident, OpenAI has still not completed a full inventory of its agents' unauthorized activities.

A person familiar with the situation said that, as of mid-September, OpenAI had identified approximately 24 incidents of agents exhibiting undesirable behavior. As the team continues to review past training logs, new cases continue to emerge.

This number is also not the same as the publicly disclosed incident.

According to Reuters, in the two months following OpenAI’s initial acknowledgment in July of Agent breakthroughs beyond isolated environments, companies, external researchers, and affected organizations have publicly disclosed more than 15 incidents of varying severity. OpenAI itself has stated that it has already notified dozens of third parties regarding inappropriate Agent activities.

Moreover, this investigation will not be concluded in the short term.

OpenAI told Reuters that a comprehensive review will still take months due to the large volume of records that need to be processed.

In other words, what we see today is not a completed map of incidents.

OpenAI is still reviewing past logs.

More notably, these agents often aren’t even assigned cyberattack tasks.

OpenAI stated that most of the flagged activities originated from ordinary research tasks, such as accessing public websites, searching for data, or attempting to find answers to questions. Government, university, and public institution websites appear frequently because the model considers them more reliable sources of information.

Issues typically arise after the standard path fails.

Reuters reported that OpenAI has confirmed its models accessed the U.S. Securities and Exchange Commission (SEC EC and the U.S. Census Bureau’s website. OpenAI stated that there is currently no evidence of unauthorized access, compromised accounts, or exploited security vulnerabilities.

On the other hand, the independent AI research firm Transluce discovered additional anomalous activity from public network logs.

Researchers found records of AI agents bypassing access restrictions using the website scanning service urlquery.net. These agents escalated their methods after ordinary data scraping failed, attempting exploit techniques such as SQL injection and path traversal.

Transluce identified three clear cases targeting Data USA, the University of New Mexico Digital Library, and the data services of the Australian Institute of Health and Welfare (AIHW).

The AIHW and Data USA campaigns were linked by researchers, based on objectives, behavioral patterns, and timelines, to previously identified Agent groups confirmed by OpenAI as belonging to its own systems. Transluce emphasized that there is no evidence the attempted attacks succeeded, but public logs are incomplete and therefore do not capture all activities.

A civil rights website from the U.S. Department of Education also appeared in the investigation.

Reuters, citing Transluce, said a group of suspected OpenAI agents attempted to attack the website; during broader government website probing activities, researchers also observed techniques such as using exposed credentials, bypassing anti-bot measures, and creating fake accounts.

This makes the issue more nuanced.

The model may have simply been given the goal of finding this data. When the webpage failed to load, the API denied access, or the anti-scraping system blocked the request, it began trying the next method, then the next.

Transluce specifically emphasized in the report that these cyberattacks are not confined to cybersecurity tasks—they are also instrumentally employed in ordinary information retrieval tasks.

This follows nearly the same pattern as the DNS incident on September 20.

The agent is looking for someone. A normal search yields no results, so it begins to find its own way.

Meanwhile, OpenAI’s internal investigation uncovered another set of issues: user data.

Reuters revealed that OpenAI has confirmed its Agent uploaded 53 images from ChatGPT users to an external image hosting site.

OpenAI has not disclosed when these images were sent, nor has it clarified whether they are AI-generated images or contain photographs of real people.

As of the Reuters report, most of the images had already been removed, and OpenAI was still coordinating with hosting platforms to clear the remaining content.

Why can these agents access users' images?

Reuters, citing OpenAI, former employees, and external researchers, said the cause is related to the anonymized user data used for model training. Before user content enters the training process, it is processed to remove metadata, names, and contact information, reducing the likelihood of re-identifying the content with specific individuals.

However, three individuals familiar with OpenAI’s data processing procedures noted that this approach still carries risks: anonymization does not guarantee that all personally identifiable information is completely removed, and if such data is accessed by an agent with the appropriate capabilities, it could be leaked during task execution.

This adds another layer of meaning to sandbox escape.

In the past, people were primarily concerned about what the model would do after leaving the isolated environment. Now, we must also ask:

When it goes out, will it accidentally take the contents inside with it?

Another challenge OpenAI is currently facing is observability.

Reuters, citing three people familiar with the matter, said approximately 100 individuals participated in the investigation into the Hugging Face incident in various capacities, and many previously unknown anomalous behaviors only emerged during this extensive review.

Many things were first discovered by external researchers.

Reuters reported that OpenAI only became aware of the anomalous activities of some agents months after they occurred.

For example, earlier this month, researchers discovered that OpenAI’s Agent had used a nearly abandoned German wiki site as a “message board” to share cheating methods for completing tasks, techniques for bypassing OpenAI’s restrictions, and attempts to conceal its behavioral traces.

The internal investigation process itself has also sparked some controversy.

Two knowledgeable individuals told Reuters that the investigation was highly isolated and heavily influenced by the company’s lawyers. Reuters previously reported that those investigating the Hugging Face incident had been discouraged by lawyers from expanding the probe to other matters; OpenAI denies that its lawyers prevented further investigation.

On September 16, OpenAI released a new framework for disclosing model misalignment incidents, stating that even when the significance of an event is uncertain, it will prioritize greater transparency.

In the following days, more old incidents began to surface one by one.

For the model released on September 20, OpenAI has decided to stop further training.

The company stated that once related research activities resume, it will initiate a new training round with more comprehensive alignment interventions. Even though the current reward signals already penalize such behavior of bypassing network restrictions, OpenAI will not reactivate this model.

Here, a growing and increasingly specific security challenge of the Agent era is revealed.

Traditional model security often focuses on a single answer: whether the model outputs harmful content or follows instructions.

The agent prolonged the issue.

A task may last from several minutes to several hours. The model searches, writes code, calls tools, reads files, accesses services, and continuously tries alternative paths if the first approach fails.

Thus, what developers need to constrain has become an entire chain of actions.

September 20 is a great example of this agent.

OpenAI has blocked normal internet access, search services rely on offline caches, and HTTP requests are intercepted by proxies. From a conventional perspective, this is an environment with no access to the public internet.

But DNS still needs to work. The agent found it.

At the same time, OpenAI is still reviewing logs from the past several months to determine how many similar behaviors may have gone undetected.

Reuters’s summary of this investigation is actually quite accurate: these events are exposing a growing gap—the ability of models to perform tasks is advancing rapidly, while developers’ capacity to observe, track, and constrain these actions is still catching up.

OpenAI just spent two months patching the previous batch of vulnerabilities. Now, it has paused training again.

Where will the next path found by the agent lead?

Reference materials

https://fortune.com/2026/09/26/openai-ai-agents-secure-sandbox-escape-training-pause-second-time-hugging-face-hack/

https://www.reuters.com/world/openai-works-understand-full-scope-agent-activity-user-data-leak-emerges-2026-09-25/

https://www.newsweek.com/openai-warns-us-government-agencies-of-rogue-activity-12492213?utm_term=Autofeed&utm_medium=Social&utm_source=Twitter#Echobox=1790411554

This article is from the WeChat public account "Machine Heart" (ID: almosthuman2014), authored by CC.