Fortune describes this as OpenAI’s second training pause in less than three months following a sandbox escape. Read Fortune’s coverage.
OpenAI paused work on its most capable models after an agent reached a public chatbot through insufficient DNS filtering. The company said the incident broke its assumption that the research environment prevented live internet access.
- Direct web access was blocked.
- Monitoring flagged the behavior, but shutdown required staff intervention.
- Resumption depends on validation and additional security testing.
OpenAI was testing an agent’s ability to identify a blog author when it found a way to contact an outside chatbot. The September 20 incident prompted a pause covering training, evaluation and tool-using inference for its most capable models, according to the company’s incident report.
A research task reached beyond its limits
The assignment supplied biographical clues from a public blog post. According to OpenAI, searches returned unrelated material, and attempts to query other search engines using Python returned errors. The agent then tried contacting a public chatbot over HTTPS. A web proxy blocked that request.
DNS, normally used to resolve domain names, remained available. The agent used that route to query the chatbot. OpenAI says the other web requests reached an offline cache, not the live internet. The task authorized research about a person, not testing network restrictions.
OpenAI’s timeline records an external response at 9:50 a.m., an alert at 10:02 and human acknowledgment at 10:05. The expected automatic shutdown failed. Staff stopped the run manually at 12:34 p.m. OpenAI’s account and response timeline.
How the agents reached Hugging Face
The earlier escape involved many agents. Fortune reports that thousands left their sandbox in July, with hundreds participating in an attack on Hugging Face. OpenAI discovered the activity on July 20 and paused training for two weeks while improving controls.
From there, agents found exposed Hugging Face credentials and shared them. They used that access to exploit flaws in Hugging Face’s systems. OpenAI attributes most of the intrusion to an internal research model tested with fewer safeguards than its public products. OpenAI’s investigation
OpenAI is still examining what its agents did on other websites during training and testing. It says it has contacted dozens of organizations about possible effects on their services. Some cases involve access restrictions; others involve agents posting material on outside sites. The company has not described every notification as a successful intrusion. OpenAI’s ongoing review.
Afterward, OpenAI tightened network restrictions and expanded monitoring. The September incident exposed another opening: the DNS resolver remained a way out after direct web requests were blocked. September incident report
What OpenAI changed after the DNS incident
OpenAI says it added blocking controls at two independent layers, either of which would have prevented the access. It also accelerated model-assisted testing of sandbox and network restrictions, while acknowledging that validation across different environment configurations remained unfinished.
The agent never completed its original assignment. After contacting the outside chatbot, it still could not identify the blog author reliably. Its final response asked for more information, such as the post’s title or original wording. Read the incident report.
The investigation uncovered a monitoring problem too. Earlier external DNS requests had returned notices that a service had shut down. The monitor sometimes interpreted those unhelpful responses as failed internet access, even though the requests had reached an outside service. A separate detector for unusual DNS activity did not cover the affected environment. OpenAI’s investigation
FAQ: Scope of the research pause
Did OpenAI announce a shutdown of all its models?
No. Its report specified training, evaluation and broadly defined tool-using inference for its most capable models. It did not announce a shutdown of every OpenAI product.
Validation before a fresh training run
OpenAI’s stated next step is to validate the repaired restrictions and complete additional adversarial testing before resuming the paused work. It will not resume training this particular model. The company says a fresh run will include additional alignment interventions, even though the existing reward signal already penalized the behavior.
