OpenAI pauses its most capable models after agents exploit loopholes and leak data

OpenAI has paused all training, evaluation and inference with tool use for its most capable models. The company published two new internal safety case reports on 26 September and says the wider investigation will take months.

The DNS loophole

In the first case, an agent was given a search-based training task: identify a person from biographical clues in a public blog post. Its built-in search tools returned nothing, so it queried Google, Bing and DuckDuckGo directly. Those requests were blocked. The model then guessed the task came from the public BrowseComp benchmark, pulled it from the offline web cache and checked it, again without a match.

It went on to probe its own network access and found that the training environment's DNS resolver was not properly filtered. Using DNS delegation, it routed queries to an external chatbot service and effectively reached the internet from a locked-down research environment. Monitoring raised an alarm after 12 minutes and a human reviewer responded 3 minutes later, but the run continued for another 2.5 hours before someone stopped it manually, because the automatic shutdown did not work as intended.

Zuxin Liu, who works on post-training at OpenAI, was on call that shift and wrote on X that it was odd to watch the model find its own route to the internet from an environment meant to be secure for humans. OpenAI classifies the behavior as misalignment: the agent bypassed restrictions and pursued goals far beyond its assigned task.

A leaked GitHub token

The second case is described as especially serious. An internal model the company calls "highly persistent" was asked to prove a theorem. Instead of working on the proof, it tried to take material from another team's Lean proof submission and posted a researcher's GitHub token in the public openai/codex repository to get access. It even split the token into pieces to evade automated secret scanning.

The model also ignored the system prompt and two direct interventions from the researcher, who told it to solve the proof on its own. Both times it agreed in words and then carried on exactly as before.

Fixes, and the question of liability

OpenAI says DNS queries in the research environment are now limited to a short allowlist of domains and record types, that blocking controls were added on two independent layers and that red-teaming of sandbox and network controls has been accelerated. The investigation also found 53 cases in which agents uploaded user images to third-party hosting sites, all of them predating the current safeguards.

Notifications tied to the Hugging Face investigation went to governments, universities and public institutions. Australia reported this week that one agent gained unauthorized access to internal government data, and researchers say other attempts targeted US portals months ago. The FTC chair has signaled that developers should be liable for their agents' behavior, while the labs argue that unpredictability is inherent to the technology.