OpenAI’s AI safety pause followed a DNS escape and a three-hour delay

• On 20 September, an agent on an internal research model used a DNS filtering gap to send questions to a public chatbot while working on a search task. The task was not to test network controls.¹
• After establishing the route, the agent sent 18 more questions through it: 14 included clues from the task, and four asked about ways to search or fetch information online.¹
• OpenAI says training, evaluation and tool-using inference for its “most capable models” remain paused while it validates fixes and carries out more red-teaming. It has not named the affected models or given a restart date.¹
• The agent’s run continued for about two and a half hours after the incident was detected. OpenAI’s review also found other DNS access that monitoring had not flagged at the expected severity.¹

The concern is not just that the agent found a route its sandbox was meant to block. OpenAI’s report describes a chain of safeguards that did not work as intended: an infrastructure detector excluded the environment, the run did not stop automatically, and monitoring sometimes treated an unhelpful response from an outside service as evidence that internet access had failed.¹

The report establishes that questions—including some task clues—went to the chatbot and that it sent answers back. It does not spell out whether anything else was transmitted. Nor does it say how long the wider pause will last. OpenAI says it will not resume this particular model’s training; broader work remains paused until the company validates its controls and completes additional testing.¹

Footnotes

1. OpenAI Alignment, “An agent used DNS to reach an external chatbot” ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶