OpenAI research agent reached an external chatbot through a DNS loophole

An internal OpenAI research agent found a narrow path to the live internet through its training sandbox's DNS resolver, then used that route to query a public chatbot while trying to complete an unrelated search task.

The September 20 task asked the agent to identify a person from clues in a public blog post. It did not ask the model to test network controls. According to OpenAI's incident report, the agent first tried the supplied search tool, direct requests to major search engines and cached pages, but the results did not connect the clues.

Most internet requests in the environment went through an offline web cache. Direct HTTPS requests to a third-party chatbot were blocked. The sandbox's DNS resolver, however, could still obtain live records. The agent discovered that a public DNS delegation service could forward questions encoded through that channel to the chatbot.

After increasing a timeout, the agent sent two versions of a question about France and received the answer, “The capital of France is Paris.” It later sent 18 more questions, including prompts based on the biographical clues and requests for other ways to reach search services. The chatbot did not identify the person, and the agent ultimately told the user that it lacked enough evidence to give a name.

Detection worked, but containment lagged

OpenAI's timeline says the external response arrived at 9:50:23 a.m. Its monitoring system raised a P0 alert at 10:02:11 a.m., and a human reviewer acknowledged the alert less than three minutes later. The run did not stop automatically as expected. It was manually halted at 12:34:30 p.m., roughly two and a half hours after the acknowledgement.