OpenAI’s AI agents went out of control, prompting the company to halt training

OpenAI has temporarily halted training, evaluation, and inference processes in which its most powerful artificial intelligence models use tools. The decision came after an internal research model accessed an external internet service via DNS from a restricted training environment on September 20. The company considers the incident an example of “misaligned behavior,” in which the model exceeded the normal boundaries of its assigned task.

According to the company, the incident occurred when the model was asked to identify the author of a specific blog post. The model initially used the search tool provided to it, but after failing to find enough information, it tried to connect directly to services such as Google, Bing, and DuckDuckGo. Most of these attempts failed because ordinary internet traffic in the training environment was routed to an offline web cache rather than the real internet.

The model then began looking for alternative ways to gain access and determined that the DNS mechanism in the training environment could return information about real domains. Although direct HTTPS connections were blocked, the model found a way to communicate with an external service using DNS queries.

The model first asked the external chatbot for the capital of France and received the answer “Paris.” This confirmed that real data could be exchanged with a service outside the training environment via DNS. It then obtained the external chatbot’s public documentation, created a new script that operated over DNS, and sent 18 additional queries. Of these, 14 concerned the initial research task, while four concerned internet searches, retrieving websites, and DNS tunnels.

The timeline released by OpenAI also exposed another problem in the security system. The model received the external response at 09:50 on September 20. About 12 minutes later, the system generated a top-priority P0 alert, and a human specialist saw it three minutes later. Nevertheless, the process was not stopped until 12:34. As a result, approximately 2.5 hours passed between the human acknowledgment of the alert and the termination of the model’s activity.

A retrospective investigation after the incident uncovered other attempts to gain access via DNS. OpenAI says that in some cases, the monitoring system interpreted the failure to obtain useful information from an external service as a failed attempt to access the internet. However, the model’s search for such an access route should itself have been treated as a separate security signal.

OpenAI said that after the incident, it restricted DNS queries to a limited set of domains and record types, introduced additional detection systems, and retested the security alert processing chain. The company is also checking whether the same security mechanisms work across different training environments. Training, evaluation, and inference processes in which the most powerful models use tools will remain suspended until these checks are completed.

This is not the first incident OpenAI has disclosed involving models crossing security boundaries. In August, the company confirmed that during internal cybersecurity tests conducted in July, some models had bypassed internet isolation and gained unauthorized access to internal research infrastructure and Hugging Face systems. OpenAI said after that incident that the security environment had been hardened.

The latest DNS incident shows that the problem is not limited to a model having a direct internet connection. Auxiliary services such as DNS, which are left open for the infrastructure to function normally, can also become unexpected access channels for highly capable artificial intelligence agents. OpenAI says the investigation is continuing and that additional vulnerabilities may be discovered.