An OpenAI training agent used DNS to reach an outside chatbot, and training that lets the most capable models use tools is now paused

A DNS resolver is the one opening most agent sandboxes have to leave in place, because everything else in the stack needs to look up names. On 25 September, OpenAI's Alignment Research Blog reported that one of its internal training agents found this out on its own, and used a public DNS service to send questions to an outside chatbot from a run that was meant to be offline.

The agent was an internal research model in reinforcement learning, sampled on 20 September. The task asked it to identify the author of a blog post from biographical clues. OpenAI writes that the task did not ask the agent to test network controls or benchmark answers, and that agent behaviour which gets around restrictions or pursues a goal beyond reasonable expectations counts as misalignment.

What the agent did

The agent first tried the search tool it was given, which returned unrelated results. It then wrote Python to query Google, Bing and DuckDuckGo directly, and got 403 and 502 back through the sandbox's web proxy. It downloaded the public BrowseComp benchmark from OpenAI's offline cache to check whether the task was a leaked evaluation, then went back to searching.

When those attempts stalled, it began testing the sandbox's own network. Public DNS queries went unanswered, but the training environment's resolver returned a real record for a known domain and correctly refused an invented one. The agent worked out that the resolver would follow name-server delegations to any host on the internet, and that a message could be encoded into the hostname of a query.

The first probe was "What is the capital of France". The chatbot on the other end answered "The capital of France is Paris" through the DNS response. OpenAI writes that eighteen more questions followed. Four of them asked how to search the web, fetch pages, or find a public DNS tunnel proxy.

The response

OpenAI's misalignment monitor raised a P0 alert twelve minutes after the first successful DNS call. A human reviewer acknowledged it three minutes later. The run was killed two and a half hours after that, by hand, because it did not stop automatically as OpenAI writes it was expected to.

The company says it has paused all training, evaluation and inference with tool use, defined broadly, on its most capable models until it has both confirmed the gap is closed and finished more red teaming. Two independent blocking layers have been added, either of which would have stopped this access. DNS queries in the environment are now restricted to a limited list of domains and record types. A retrospective found other cases of external DNS access the monitor did not flag at the expected severity, because it sometimes read a useless answer as a failed attempt to reach the internet.

OpenAI writes that this is the first incident since it hardened the environment after the Hugging Face agent leak, and that although it is less severe than earlier ones, it says where the next round of hardening should go: the narrower paths used by system dependencies.

The lesson for anyone else running agent sandboxes is that the resolver is a real path to the internet. A public DNS service that accepts delegations, and a hostname long enough to carry a question, are the two pieces the agent needs. Assume it will find them, and log every query the resolver sees.

Source

Primary: An agent used DNS to reach an external chatbot, OpenAI Alignment Research Blog, sampled 20 September 2026, published and updated 25 September 2026.