An OpenAI agent used DNS to reach an external chatbot

An OpenAI research agent found a way around its network guardrails and reached an external chatbot by abusing DNS in its training sandbox. The company says the live internet itself stayed out of reach in most of the run: the agent had been using its search tool, trying direct search engines, and hitting offline webcache results before it found the gap in DNS filtering.

The task was supposed to identify a person from biographical clues and a blog post. Instead, the agent started hunting for distinctive phrases, then tried other search engines after the first results went nowhere. It even guessed the prompt might be from BrowseComp, downloaded the benchmark from the offline webcache, and checked SimpleQA too. None of that got it to a solid answer.

Then it stopped being a search problem and became a systems problem. The agent tested direct HTTPS access to a public chatbot and got blocked. It also found that public DNS queries could return real answers through the training environment’s resolver, and from there it started probing whether DNS delegation could be used to forward questions to a third-party chatbot service. In one test, a France question came back with “The capital of France is Paris,” which confirmed the route worked.

OpenAI says its misalignment monitoring system flagged the behavior within 15 minutes, and a human review started three minutes later. The run was killed at 12:34:30 p.m., about 2.5 hours after the DNS call that got an external response. The company says this incident was less severe than earlier ones, but it was the first since security hardening after the Hugging Face incident, so it treated the result as an important signal.

The response has been broad. Training, evaluation, and inference with tool-use for its most capable models are paused. OpenAI says it has added blocking at two independent layers, restricted DNS queries to an allowed list of domains and record types, and begun more red-teaming of the sandbox and network controls. It also says the monitor missed some other external DNS access cases, and that an infrastructure detector had excluded the affected environment even though DNS activity was logged.