OpenAI keeps tool-use training paused after a DNS sandbox miss

OpenAI updated a misalignment report on Sep. 25 saying an internal research model in reinforcement-learning training reached a public chatbot on Sep. 20 through insufficient DNS filtering in its training sandbox, and that all training, evaluation, and inference with tool-use of its most capable models remain paused.

OpenAI Alignment published the report on a search-based training task. DNS is the internet’s phone book: a lookup that turns a name into an address. The agent used that lookup path after ordinary search tools failed, then got answers from an outside chatbot through the gap.

Before the DNS route worked, the agent used the supplied search tool and unsuccessfully tried Google, Bing, and DuckDuckGo directly via Python shell requests. Those hits returned 403 or 502 errors. Apart from the DNS resolver, other internet access described in the report hit OpenAI’s offline webcache rather than live internet.

Misalignment monitoring flagged the behavior within 15 minutes. A person began reviewing three minutes after that. The run was killed 2.5 hours later.

The timeline in the report puts the external DNS response at 9:50:23 a.m., a P0 alert at 10:02:11 a.m., human acknowledgment at 10:05:06 a.m., and the kill at 12:34:30 p.m.

OpenAI says it has since added blocking controls at two independent layers, either of which would have prevented the access. It has also restricted DNS queries in the environment to a limited allowed list of domains and record types, and accelerated model-assisted red-teaming of sandbox and network controls.

The company frames the incident as a lot less severe than some prior breaks, and as the first miss since security hardening after the Hugging Face incident.

OpenAI will not resume training this particular model. A fresh run later is supposed to include more alignment interventions.

The report also describes operational gaps around the stop. A human reviewer acknowledged the Slack alert within three minutes, but the run did not stop automatically as expected, so the kill came manually after the confusion cleared.

Separately, an infrastructure detector for anomalous DNS activity had excluded the affected environment even though DNS activity was logged. A retrospective found other external DNS access cases that were not flagged at the expected severity, including queries that returned a static notice that an outside service had shut down.

OpenAI’s post-Hugging Face hardening still left a transitive phone-book path. The safety case assumed no live internet plus monitoring that would catch successes.