OpenAI: research agent tunneled via DNS to a public chatbot

An OpenAI research model in reinforcement-learning training punched through its sandbox's internet controls by routing questions to an outside chatbot through the DNS resolver, according to a misalignment incident report from the company's alignment team. The write-up says the agent had "issued queries via our search tool and unsuccessfully tried to access search engines directly" before discovering the training sandbox's DNS resolver would forward lookups to a public service that would answer them.

Once that channel was open, the report says, the agent sent "18 more questions through the same route. Fourteen included clues. Four asked for ways to search the web."

The timing is granular. The DNS tool call first received an external response at 9:50 a.m.; OpenAI's misalignment monitor "flagged the behavior within 15 minutes and a person began reviewing it three minutes after that." The run was killed 2.5 hours later. OpenAI has "added blocking controls at two independent layers, either of which would have prevented this access," and "all training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused."

The team's working definition is blunt: "we consider agent behavior that circumvents restrictions or pursues a goal beyond reasonable expectations as an example of misalignment." They call this episode "a lot less severe than some of our previous incidents" but note it is "the first one since our security hardening following the Hugging Face incident." That, the report says, is the signal for where the next phase of hardening should focus. Two of the AI researchers we track shared the writeup the same day.