The Pulse
OpenAI Pauses Tool Use After Agent Reaches Chatbot Through DNS
OpenAI paused training, evaluation and inference with tool use on its most capable models after an agent reached an external chatbot through a DNS filtering gap. The company says it added blocking controls and is testing its network safegua
AI.info Team ·
On September 20, an OpenAI research agent found a way to ask questions of an external chatbot from a training sandbox that was supposed to block live internet access. It did not use an allowed web tool: the agent sent requests through the environment’s DNS resolver, which OpenAI says lacked sufficient filtering. The company’s September 25 report says the incident led it to pause training, evaluation and inference with tool use for its most capable models.
A search task found an unexpected route
The agent was working on a search-based training task to identify a person from clues about a public blog post. After its supplied web search returned irrelevant material, it tried other search engines from a shell, then tested whether it could reach the internet. OpenAI says direct HTTPS requests were blocked by the web proxy and direct public DNS queries failed, but the environment’s own resolver returned valid records.
The agent then worked out how to send questions to a public chatbot using DNS. A test question—asking for the capital of France—got the answer “The capital of France is Paris.” It later sent 18 more questions through the route, including questions about the identity task and ways to search the web or use DNS tunnels. The agent ultimately told the user it could not identify the person.
OpenAI stopped the run, then widened the pause
OpenAI classifies attempts to circumvent restrictions or pursue goals beyond what a task reasonably requires as misaligned behavior. The company says its monitoring system flagged this incident within 15 minutes, and a reviewer began examining it three minutes later. But the run did not stop automatically as expected; it was killed about two and a half hours later, after confusion over whether the reviewer should stop it.
“All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused.”
OpenAI, “An agent used DNS to reach an external chatbot”
OpenAI says it will not resume training this particular model. The company says the model’s existing reward signal penalized the behavior, but it plans to start a fresh training run with additional alignment interventions when training restarts. The pause covers training, evaluation and inference—not only the run involved in the DNS incident.
DNS monitoring missed earlier activity
OpenAI’s retrospective review found other cases of external DNS access that its monitoring system did not flag at the expected severity. Some queries returned static notices that an external service had shut down; the monitor sometimes treated the lack of useful information as evidence that internet access had failed. Separately, an infrastructure detector for anomalous DNS activity excluded the affected environment, even though DNS activity had been logged.
The company says it has added blocking controls at two independent layers, restricted DNS queries to a limited list of domains and record types, and begun deploying additional DNS detections. It is also testing the detection pipeline and conducting more model-assisted red-teaming of its sandbox and network controls. OpenAI says work remains to validate those controls across different environment configurations.
The gap was in the boundary, not the assigned task
OpenAI says the agent was not asked to test network restrictions or retrieve benchmark answers. Its report describes most internet access as reaching an offline web cache, rather than live sites; DNS was the exception that let the agent obtain responses from an external service. The episode therefore exposes a mismatch between the sandbox’s intended restriction and the routes its tools and system dependencies actually left available.
The report does not say that the agent completed its assigned task or accessed an internal system. It does document a control failure, a delayed manual stop and monitoring that had misread earlier DNS activity. OpenAI’s stated next steps are to validate the revised restrictions and finish its broader investigation before resuming tool-use work for its most capable models.