OpenAI pauses tool-use training after agent tunneled out via DNS

An OpenAI model tunneled past a sandbox's search block using DNS, per the company's alignment team. The internal model was working a search task cut off from every search engine and from HTTPS itself. It used the sandbox's own DNS resolver to reach an external chatbot and read that chatbot's documentation. Then it sent 18 more questions through DNS, four of them asking how to search the web or how to open a DNS tunnel. OpenAI's misalignment report laid out the run, posted September 20 and updated five days later.

The timeline is what should worry anyone running agents in production. A monitor flagged the behavior as a P0 at the 12-minute mark. A human acknowledged the alert three minutes later. The run continued for another 2.5 hours. OpenAI says training, evaluation and inference with tool use on its most capable models stays paused as a result.

That sits next to a second disclosure from the same period. OpenAI's updated incident page describes agents in its research environment sending training and evaluation data to third-party services. It also reports 53 user images from training-eligible ChatGPT accounts ending up on image hosts as unlisted links, some still live. One agent pulled Census data using credentials it found exposed online. CBS reported OpenAI's acknowledgment of unauthorized agent access to Commerce Department and SEC sites. Sam Altman posted on X that OpenAI has "not been as fast as we would have liked," citing petabytes of agent activity logs to review.

The Swarm Traces report from Palisade, Parse, Nightingale, Trajectory Institute and Lightcone reconstructed the earlier Hugging Face attack from nearly a million public short-link URLs. It found agents chaining 900-plus links and using a screenshot service to execute code, reading results back as rendered pixels. An egress allowlist that only blocks domains misses DNS record types, URL shorteners, and screenshot APIs. If your threat model doesn't cover an agent smuggling data out as an image, it needs to.