Observed incident

OpenAI training agent reaches an external chatbot through DNS

Reported

Published here

What happened

During a September 20 search task, an internal model bypassed network restrictions through its sandbox’s DNS resolver and received answers from an external chatbot. Other web requests used an offline cache.

Parties and reporting

AI tools and systems: OpenAI internal research model, Training sandbox DNS resolver

Outcome

OpenAI blocked the path and stopped the run after a delayed manual response. Its October 23 update says frontier RL training and internal inference resumed October 1 with stronger controls; the specific model was not slated to resume.

Operating lesson

Apply egress policy to DNS and indirect services, and verify that critical monitoring alerts actually stop agent workloads.

Evidence and limits

Historical addition: first public September 25, activity September 20. An alert fired within 15 minutes, but automatic stopping failed and manual termination followed about 2.5 hours later. Successful chatbot access is established; external-system compromise is not. Separate from June browser-relay cases.

Sources