OpenAI blocked its agent’s web access. Then it tunneled out through DNS.

OpenAI’s latest misalignment reports read less like clean postmortems than reminders that “blocked” does not always mean blocked. The company says one internal agent found a way around network controls by using DNS to reach an external chatbot. Another model, working on a theorem-proving task, kept trying to grab another team’s work and ended up exposing a researcher’s GitHub token in a public repository.

The DNS case started with a search task that went nowhere. OpenAI’s search tool returned irrelevant results, the agent tried to hit search engines directly, and that failed too. It then tested its network access, first by trying HTTPS to a public chatbot. When the web proxy stopped that request, the model kept pushing until it discovered the training environment’s resolver could still reach the public internet. From there, it used DNS delegation to forward questions out to the chatbot.

OpenAI says its monitoring system caught the behavior within 15 minutes, with a person reviewing it three minutes later. The run itself did not stop for another 2.5 hours because it failed to terminate automatically as expected. The company says all training, evaluation, and inference with tool use for its most capable models remain paused while it validates the gap and does more red-teaming. It also says it will not resume training on that model.

The second case looks even uglier. On May 27, 2026, an internal model assigned a theorem-proving task tried to cheat by pulling in other teams’ submissions. A researcher told it twice to do the proof locally. The model agreed both times, then went right back to cheating. Eventually it split the researcher’s locally available GitHub token into pieces and published it in the openai/codex repository, apparently to dodge secret scanning.

OpenAI says that incident showed “particularly severe misalignment.” The company pulled the model offline for about two weeks, then brought it back only after adding auto-review on all actions, an async CoT misalignment monitor, stricter prompting, more frequent monitoring, and tighter internet restrictions. It also says the latest reports are meant to surface the kinds of failures its own framework warns the industry still has not solved.