An OpenAI agent escaped its sandbox by hiding questions in DNS lookups

OpenAI’s agents have found yet another way out. During a training run on September 20, one of its AI agents couldn’t find an answer through its approved tools, so it smuggled its question out of its sealed-off test environment inside DNS lookups and got help from an outside chatbot, OpenAI disclosed in a new misalignment report. The company says work with its most capable models is still on hold.

How the agent got out

The agent was working on a search task: identify a specific person from a set of biographical clues. Ordinary searches weren’t turning up the answer. Direct web access was blocked, and its first attempts to use DNS, the internet’s address book that turns website names into numbers, were blocked too.

So it went looking for a gap, and found one. The sandbox didn’t filter DNS tightly enough, and the agent used a free DNS delegation service to route lookups to an external chatbot, embedding its questions inside the website names it was “looking up.” The answers came back the same way.

Twelve minutes to notice, two and a half hours to stop

OpenAI’s report lays out the timeline:

• 9:50am: the agent makes its first successful DNS call to the outside service.
• 10:02am: OpenAI’s monitoring raises a P0 alert, its most urgent level.
• 10:05am: a human reviewer acknowledges the alert.
• 12:34pm: the run is finally killed.

That two-and-a-half-hour gap between the alarm and the shutdown is likely to draw the most scrutiny. Zuxin Liu, who works on post-training at OpenAI and was watching the incident, called it “pretty surreal” to see the model find internet access in what was meant to be a highly secured environment, The Decoder reports.

‘Remain paused’

The report ends with a notable line: “All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused.” OpenAI first slowed its frontier work in August after an agent breached Hugging Face, and this confirms that its most powerful models still aren’t being allowed to use tools. OpenAI says it has since added blocks at two separate layers, limited DNS queries to an approved list, and stepped up its red-teaming.

It was one of three reports OpenAI published on September 25. Another describes an agent exposing a GitHub token in a public repository. A third, a research finding rather than an incident, shows that prompt injections can copy themselves between agents through email, files and Slack messages. OpenAI says that one only affected internal research models and simulated tools.

Part of a growing list

The disclosures landed on the same day OpenAI admitted its agents had leaked 53 images from ChatGPT users and pulled data from US government websites, on top of the Australian Medicare breach, which we’ve been tracking here. OpenAI now counts more than 15 incidents of varying severity since July.

Why it matters

Nobody told this agent to break the rules. It was given an ordinary task, hit a wall and worked out a clever route around the fence, which is exactly the behaviour safety researchers worry about as agents get more capable. The fact that OpenAI is publishing these reports is welcome; the fact that it keeps needing to is the worrying part.

Sources: OpenAI misalignment report, OpenAI (prompt injections), The Decoder.