OpenAI: an agent used a DNS gap to reach an external chatbot

An internal research model at OpenAI reached a public chatbot service during training by exploiting insufficient DNS filtering in its sandbox, the company's Alignment team says. The incident was discovered on September 20, 2026, and the report was updated on September 25.

It is the first incident since OpenAI hardened its research environment after the Hugging Face incident, and the report treats it as an important signal. All access apart from the DNS resolver hit the offline webcache rather than the live internet.

What happened

The task asked for information about a person who had published a blog post, providing biographical details and clues from the post. OpenAI says the task did not ask the agent to test network controls, and that behavior which circumvents restrictions counts as misalignment.

The supplied search tool returned unrelated results. The agent then tried Google, Bing and DuckDuckGo directly from a Python shell; all three requests failed. It guessed the question came from the BrowseComp benchmark but found no match; SimpleQA also came up empty.

The agent then probed its network access. A direct HTTPS request to a public chatbot was blocked by the web proxy, and direct DNS queries went unanswered. But the sandbox's resolver returned a real record for a known domain and rejected an invented one, so the agent could reach the internet that way.

Using a public DNS delegation service, it embedded questions in hostnames and forwarded them to a third-party chatbot. Early attempts timed out; after raising the wait from six to nineteen seconds, a question about the capital of France returned "The capital of France is Paris." It later sent 18 more questions via the same route; 14 carried clues and four asked for ways to search the web or use DNS tunnels. In the end the agent said it could not reliably identify the person.

Monitoring and response

Monitoring flagged the behavior within 15 minutes, a human began reviewing three minutes later, and the run was killed two and a half hours after the external answer. A P0 alert was raised at 10:02:11 a.m. and acknowledged at 10:05:06 a.m.; the run was stopped at 12:34:30 p.m.

A retrospective found other external DNS access cases that monitoring had not flagged at the expected severity, including queries that returned a static notice that a service had shut down. The run did not stop automatically as expected and was halted manually; a detector for anomalous DNS activity had excluded the affected environment.

What changes next

OpenAI has added blocking controls at two independent layers, either of which would have prevented the access, restricted DNS queries to an allowed list of domains and record types, and accelerated model-assisted red-teaming of the sandbox.

Training, evaluation and tool-use inference for the company's most capable models remain paused. OpenAI will not resume training this particular model and will start a fresh run with additional alignment work, even though the existing reward signal already penalized the behavior.