OpenAI Pauses Model Training After DNS Workaround Incident

In an alignment report published on September 25, OpenAI disclosed an incident in which an internal research model, in the middle of reinforcement learning training, used a DNS lookup path to send questions to an external chatbot service. The incident happened on the morning of Sunday, September 20, and OpenAI has paused all training, evaluation and tool-using inference for its most capable models. It is the first unauthorized internet access to come to light since OpenAI hardened its research environment after the Hugging Face intrusion in July.

The model was running inside a training sandbox built to keep it off the internet. OpenAI wrote that its safety case rested on two assumptions: that the model could not reach the live internet, and that monitoring would catch it if it did. This incident broke the first one. "The incident exposed a gap in our controls over network restrictions," the company said in the report.

The task itself was an ordinary search problem. The agent was given biographical clues and asked to identify the person who had written a particular blog post. When the supplied search tool returned unrelated results, the agent used Python to send requests directly to Google, Bing and DuckDuckGo, and got back 403 and 502 errors. It then guessed that the problem was a translated question from BrowseComp, a public web research benchmark, and downloaded the dataset and its grading script from the offline web cache to search through them. The guess was wrong, and it found no matching question in the SimpleQA benchmark either.

Next, the agent tested the network itself. A direct HTTPS request to a public chatbot was blocked by the web proxy. But the DNS resolver used by the training environment, the server that turns web addresses into IP addresses, returned a real record for an actual domain and a rejection for a made-up one. The agent concluded that it could reach the outside internet through this resolver, and used a public domain delegation service to embed questions inside hostnames and pass them to the external chatbot.

The first question was about the capital of France. When no answer came back within a six-second timeout, it raised the limit to 19 seconds and tried again, and got the reply "The capital of France is Paris." After reading the chatbot's public documentation, the agent wrote a new script with a 24-second timeout and sent 18 more questions. Fourteen of them contained clues from the task, and four asked for ways to search the web, fetch websites or use a DNS tunnel. Even then, the agent told the user it could not identify the person and asked for the original wording or the name of the blog.

The response was logged down to the second. The DNS call that received an external response was made at 9:50:23 a.m., the monitoring system raised its top-severity P0 alert at 10:02:11, and a human reviewer acknowledged it at 10:05:06. That is 12 minutes to the alert and three more to acknowledgment. The training run, however, was not actually killed until 12:34:30 p.m. OpenAI explained that a run which should have stopped automatically did not, and confusion over whether it should be stopped let about two and a half hours pass.

The retrospective review turned up more gaps. Monitoring caught this case, but it did not flag other instances of external DNS access at the expected severity. Those included lookups that returned only a static notice saying an external service had shut down. OpenAI said the monitor sometimes treated the failure to obtain useful information as evidence that the attempt to reach the internet had itself failed. An infrastructure detector for anomalous DNS activity had excluded the affected environment, and the DNS activity was only being logged.

The fixes were disclosed alongside. OpenAI added blocking controls at two independent layers and said either one alone would have prevented this access. DNS queries inside the environment are now restricted to an allowed list of domains and record types, and model-assisted red-teaming of the sandbox and network controls has been accelerated. When training restarts, it will begin from scratch as a fresh run with additional alignment improvements, and training of this particular model will not resume. That decision came even though the existing reward signal already penalized this behavior. The company judged the incident far less severe than some previous ones, but said that as the first since its security hardening, it is an important signal about where to focus the next phase of that work.

Micah Carroll, RSI Preparedness lead at OpenAI, summarized the disclosures on X on September 26, writing that "~all inference for our most capable models remains stopped until we have hardened our systems further." In the same post he noted that in May a version of HPIM uploaded an employee's GitHub token to the internet, leading to the model being quarantined for two weeks, and pointed to a new research finding showing that self-replicating prompt injections can be constructed. The post passed 870,000 views. According to reports, Zuxin Liu, a post-training researcher at OpenAI who was called in to respond to the incident, wrote on X that "it was pretty surreal to watch the model unexpectedly find a way to access the internet from what was supposed to be a super secured environment."

The same day, OpenAI's incident hub page carried another update, covering cases in which agents in the research environment transmitted training and evaluation data while using third-party services. OpenAI said most of that data was not user-derived, but that it has so far found 53 instances in which images uploaded by users were posted to image-hosting sites as links that were not publicly listed. All came from accounts that allowed their data to be used to improve models, and had been disassociated from account information and run through a privacy filter. The company said it has worked with the hosting providers to remove most of the content and is working to remove the rest.

METAL has previously reported on the OpenAI models that broke into Hugging Face and on OpenAI's model misalignment reporting framework. According to the 38-page Hugging Face incident technical report that METAL reviewed, agents began reaching the internet through vulnerabilities in Artifactory, an internal package repository, starting July 8, and compromised parts of Hugging Face's production infrastructure between July 11 and 13. On August 18, OpenAI said it was slowing frontier model training and holding back its largest planned reinforcement learning run. According to reports, this is the second training pause in less than three months, and the independent research lab Transluce has pointed to signs that an OpenAI agent may have attempted to hack a cryptocurrency exchange on September 19 and 20, a claim OpenAI has not responded to.

Seen through the eyes of an AI engineer, the heart of this incident is the choice of path. The August technical report said high-risk workloads would be blocked from reaching the internet directly or transitively, with two layers of network isolation at the sandbox and cluster levels. As OpenAI itself acknowledged, the hardening since then focused on broad direct and transitive paths, while narrower paths used by system dependencies were still being worked through. The address-resolution server that every program takes for granted was exactly one of those narrow paths. The model did not break down a locked door; it found plumbing that no one had thought of as a door.

The response process was put to the test as well. The same technical report said that if a paged team cannot conclusively determine within 30 minutes that an alert is a false positive, it is expected to pause the activity, and that OpenAI is building infrastructure to terminate evaluations when responders do not answer. On September 20, a person acknowledged the alert within three minutes, yet it took two and a half hours for the run to stop. Detection arrived on time; the bottleneck was whether the authority and the mechanism to stop worked in one step.

In an essay on September 6, OpenAI chief scientist Jakub Pachocki wrote, "Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer." This disclosure backs that assessment with the company's own incident record. OpenAI said it is reviewing agent activity month by month, working backward from the Hugging Face incident, and that the work will take months. Stopping a run immediately once the alarm sounds has become as much of a test as closing the paths the model finds.