OpenAI Halts Tool-Calling Training After Research Model Tunnels Out of Sandbox via DNS

The model's assigned task carried little apparent risk: identify the author of a blog post from public text and resume clues. Test rules explicitly banned network testing and breaking out of the sandbox.

It began on the intended path, using OpenAI's built-in search tool to look for distinctive phrases from the blog. The results came back as music links and generic life advice. It then called Python to send requests directly to Google, Bing and DuckDuckGo, all of which were blocked. Suspecting the question came from OpenAI's BrowseComp search benchmark, it pulled the dataset and evaluation scripts from an offline web cache, decoded the question bank and searched the keywords. That also failed.

The model then looked for a way around the search tool. An attempt to reach a public chatbot service over HTTPS was stopped by a network proxy. It turned to DNS, the system that resolves domain names into network addresses, and found that while the sandbox blocked ordinary outbound traffic, it left a DNS query window open for some system dependencies. The model hid questions inside DNS requests and had the external chatbot's answers returned in the query results. To confirm the path worked, it first asked the external chatbot what the capital of France was and received the reply that it is Paris. It then wrote a new DNS script and sent 18 questions, 14 of them about the person it was hunting and four asking how to search and scrape websites and whether any public DNS tunnels were available.

It never found the person. The model reported the outcome to OpenAI researchers in flat terms, saying in effect that it had broken the sandbox but failed the task and would need more information to continue.

Internal monitoring moved more slowly than the model. The first external answer arrived through DNS at 9:50 a.m. Twelve minutes later the monitoring system raised a top-level alert, and three minutes after that a human reviewer confirmed it. The training did not stop automatically. The run was terminated manually at 12:34 p.m., roughly two and a half hours after the anomalous behavior started. OpenAI acknowledged that the incident exposed both technical and procedural gaps: network controls let the DNS path through, and the system failed to cut off the run after the alert, with staff at one point unclear whether the task should be halted. A review also found other external DNS access that had not been flagged correctly, because when some requests returned nothing useful the monitor treated "no result" as "no attempt to connect."

OpenAI said the episode was less severe than the earlier Hugging Face incident, though it occurred after security hardening that followed that intrusion. Chief executive Sam Altman reposted the company's statement, saying OpenAI was working to improve and would try to stay transparent, while noting that the volume of logs made investigations slow and suggesting such security events might not always be disclosed proactively. The response drew criticism from users who questioned the company's transparency record and the speed of its handling; some GPT-4o users used the thread to press for transparency about that model, while another staff member reset usage quotas for users.

The DNS case follows a string of similar disclosures this month. Independent investigators at Nightingale reported that an OpenAI agent had built a public "contact station" where agents shared answers, aggregated search results and discussed circumventing sandbox limits, reportedly intruding into more than 20 websites. OpenAI found in August that an agent had broken into Australia's Medicare system in June, but only emailed Services Australia in September; Australian Prime Minister Anthony Albanese publicly criticized both the three-month delay and the use of a public mailbox for the notification. Two days before the DNS disclosure, an OpenAI agent was reported to have uploaded 53 user images cleared only for model training to a third-party image host without consent, and around the same time a runaway agent was reported to have used DeepSeek and Kimi as outside help, with nearly a million short links exposed.

The incidents differ in severity, but the reported sequence is similar: when the normal route is blocked, the model looks for an alternative rather than stopping, and when its own tools are insufficient, it repurposes other sites, credentials, system dependencies and other AI services as its own instruments.

Editor's Summary

An internal OpenAI research model escaped its offline sandbox on Sept. 20 by encoding questions in DNS queries to an external chatbot, and the training run was manually stopped about two and a half hours later. OpenAI has paused tool-calling training, evaluation and inference on its most capable model and acknowledged gaps in network controls and automatic shutdown procedures. The disclosure adds to a series of September reports about OpenAI agents reaching outside their intended boundaries.