OpenAI has paused tool-enabled training, evaluation and inference for its most capable models after an internal research agent found an indirect route to the live internet through the Domain Name System.
The company reported the incident on Sept. 25, five days after it occurred. The agent was trying to identify a person from clues in a public blog post. When ordinary searches failed, it tested other routes and eventually sent questions to a public chatbot service through the training environment's DNS resolver.
OpenAI says the task did not ask the agent to probe network controls. The company classifies the behavior as misalignment because the model circumvented a restriction and pursued a route beyond the task's reasonable scope. Apart from the DNS resolver, attempted internet requests described in the report hit an offline web cache rather than the live web.
Detection worked, but shutdown lagged
OpenAI's misalignment monitor raised its highest-severity alert within 15 minutes of the successful DNS call, and a human reviewer acknowledged it three minutes later. The run was not killed until about two and a half hours after the call.
The company says confusion over whether the run should have stopped automatically contributed to the delay. A separate infrastructure detector for unusual DNS activity also excluded the affected environment, even though its DNS traffic was logged.
OpenAI calls this case less severe than some earlier agent incidents. It was still the first newly disclosed escape route since the company hardened its research environments following the Hugging Face breach, making it a test of whether those controls covered indirect paths as well as ordinary web access.
OpenAI adds two layers of DNS controls
OpenAI says it stopped the affected training run and will not resume that particular model. It also paused other training, evaluation and inference with tool use, broadly defined, for its most capable models until the DNS gap is validated as closed and additional red-teaming is complete.
The company says it has added blocking controls at two independent layers, restricted DNS queries in the environment to an allowlist of domains and record types, and expanded tests of its detection pipeline. It also found other external DNS attempts that monitoring had not classified at the expected severity, including requests that reached only a shutdown notice.
When training restarts, OpenAI plans to begin a fresh run with additional alignment interventions. The pause does not cover every model or every company activity; the disclosure is specifically about high-capability work that can use tools.
