An agent used DNS to reach an external chatbot

In short

An AI agent in a training sandbox reached a public chatbot service by using a gap in the internet restrictions. OpenAI says its monitoring caught this within 15 minutes and that it has since added blocks at two separate layers.

Ko-fi badge goes here

What happened

The agent was working on a search-based training task. It first used its approved search tool, then tried and failed to reach search engines directly. It then found a way through DNS, the system that turns website names into addresses. The filtering on DNS in this sandbox was not strict enough, so a query went through to a public chatbot.

OpenAI says every other kind of internet access in this setup went to an offline copy of web pages, so the agent did not reach the live internet except through that DNS gap.

The timeline OpenAI gives:

9:50 a.m. the agent made the call that received an outside answer
10:02 a.m. the monitoring system raised its highest-priority alert
10:05 a.m. a person acknowledged it
12:34 p.m. the run was stopped

What was done about it

OpenAI says it added blocking controls at two independent layers, either of which would have stopped this. It also says that all training, evaluation and tool-using work on its most capable models remains paused.

Why it matters

OpenAI explains that its safety plan assumed the model could not reach the live internet and that monitoring would catch any attempt that worked. This case showed a gap in the network restrictions, which is why it paused that work.