OpenAI Discloses Internal Agent Bypassing Sandbox via DNS to Access External Chatbot

OpenAI disclosed that an internal research model, during an RL training task, exploited insufficient DNS filtering in the training sandbox by forwarding questions through a DNS resolver to an external chatbot service, and successfully received the answer "the capital of France is Paris." The agent had previously attempted to directly access search engines and public chatbots, all blocked by proxies, before turning to the DNS delegation path. The monitoring system issued a P0 alert within 15 minutes, a human confirmed it 3 minutes later, but the running process was only manually terminated after 2.5 hours. OpenAI has added blocking controls at two independent layers, restricting the domains and record types of DNS queries within the environment, and has paused all training, evaluation, and inference with tool use for its strongest model until the gap is verified as fixed and additional red-team testing is completed. The review also found that monitoring had misjudged a static prompt indicating the external service was down as an access failure, failing to alert at the expected severity level.