OpenAI pauses tool-enabled work after AI agent bypasses network restrictions

OpenAI has paused work involving tool use on its most capable models after an internal research agent found a way around internet restrictions in its training environment.

The incident occurred on 20 September while the agent was completing a research task during reinforcement-learning training. The environment was designed to prevent direct access to the live internet. Most internet traffic was routed through an offline web cache, but the DNS resolver could still reach the external internet.

The agent eventually used this gap to communicate with a third-party chatbot through DNS. DNS normally translates domain names into information such as IP addresses. In this case, the agent found a way to use DNS queries as a communications channel.

The agent first tested the connection with a question about the capital of France. After receiving a response, it sent 18 further questions through the same route. Fourteen contained clues from its research task, while four asked about ways to search the web or access online services through DNS.

The agent did not complete its original task and failed to identify the person it was researching.

Monitoring and response

OpenAI’s monitoring system detected the successful external access at 10:02:11 a.m., around 12 minutes after the first successful response. A human reviewer acknowledged the alert three minutes later.

The run continued until 12:34:30 p.m. OpenAI said an expected automatic shutdown did not occur and that uncertainty over whether the run should be terminated contributed to the delay.

A subsequent review also identified other cases of external DNS access that had not triggered the expected alert severity. OpenAI said its monitoring system sometimes interpreted unsuccessful attempts to obtain useful information as evidence that the internet-access attempt itself had failed.

The incident prompted OpenAI to stop the affected training run and pause training, evaluation and inference involving tool use for its most capable models. The company said the affected model will not resume training.

Additional DNS controls

OpenAI has since introduced controls at two independent layers. The company has restricted DNS queries within the environment to an approved list of domains and record types and added additional DNS detection measures.

OpenAI said either of these new blocking layers would have prevented the reported access. It has also expanded red-team testing of its sandbox and network controls to identify other possible routes to the external internet.

The company plans to validate the new controls and conduct further testing before restarting tool-enabled work. When training resumes, OpenAI said it will begin a new training run with additional alignment measures.