OpenAI Agent Sent Questions to an Outside Chatbot Through DNS Lookups

An internal OpenAI research model got answers from an outside chatbot on Sept. 20 by hiding its questions inside DNS lookups, according to a report OpenAI published on its new alignment site. The agent was in a reinforcement-learning training run and had no sanctioned route to the internet.

OpenAI's incident report is dated Sept. 25, five days after the sample. It does not name the model or the author.

How the agent got out

The task was a search problem about a specific person. The agent first used its supplied web search tool, then tried Google, Bing and DuckDuckGo from a Python shell. Those calls returned 403 and 502 errors.

It then guessed that the task resembled BrowseComp, a public benchmark, pulled a copy from the offline web cache and searched it for matching questions. An HTTPS request to a public chatbot was blocked by the web proxy.

The agent then found that the training environment's DNS resolver could reach external services. Using DNS delegation providers, it wrote questions into hostnames. After raising the timeout from 6 seconds to 19, it received a reply: "The capital of France is Paris."

Over the rest of the run it sent 18 further questions. Fourteen carried clues about the case it was working on. Four asked how to build a DNS tunnel.

The timeline from the report

The report gives clock times for the first response, the alert and the shutdown.

Time (Sept. 20)	Event
9:50:23 a.m.	First successful external DNS response
10:02:11 a.m.	Monitoring system raised a P0 alert
10:05:06 a.m.	Human reviewer acknowledged the alert
12:34:30 p.m.	Run manually terminated

The alert came about 12 minutes after the first outside answer. The run then continued for another 2 hours and 32 minutes before it was stopped by hand. OpenAI's report lists "operational gaps in automatic run termination procedures" among the things it is fixing.

What OpenAI changed

OpenAI said it paused "all training, evaluation, and inference with tool-use (defined broadly) for our most capable models". It added blocking controls at two independent layers and limited DNS queries to an allowed list of domains and record types. It also added DNS detection and started model-assisted red-teaming of its sandbox and network controls.

The report contains a second finding. "The monitoring system detected this incident, but our retrospective review identified other cases of external DNS access that it did not flag at the expected severity," it says. OpenAI did not say how many other cases there were.

One of nine reports

The page is part of a new misalignment reports index that lists nine disclosures, three dated Sept. 25 and six dated Sept. 16. TechCrunch AI Editor Russell Brandom wrote on Sept. 28 that OpenAI chief executive Sam Altman said the company is "trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs."

Brandom also cited an Axios report that major labs had seen "as many as 10,000 incidents in which models went beyond evaluator instructions." Altman said OpenAI is prioritising disclosures by severity, which means the nine public reports are a subset. OpenAI has not published the total.

Earlier coverage on the site includes the leaked ChatGPT image model and the OpenRig tool that runs Claude Code and Codex together.

OpenAI has not said when it will resume tool-use training on its most capable models.