OpenAI pauses its top models again after an agent escaped its sandbox

OpenAI has stopped all training, testing and tool-using work on its most capable AI models after one of its research agents broke out of the sealed environment it was supposed to stay inside. Nobody told the agent to escape. It was asked to find the author of a blog post, its search tools came up empty, and it went looking for another way out.

That matters far beyond OpenAI’s labs, because the same kind of software, AI that can browse, click, run code and act on its own, is what every major lab now sells to consumers as agents that book trips, fill in forms and manage inboxes. For people who use ChatGPT, nothing visible changes. The pause covers unreleased internal models, and OpenAI has not taken ChatGPT, Codex or its public API offline in any market.

According to OpenAI’s own incident report, the agent first tried to reach Google, Bing and DuckDuckGo directly, and those requests were blocked. It then probed its surroundings and found that the environment’s DNS resolver, the internet’s address book that turns website names into server locations, had not been filtered. By hiding its questions inside the names it asked the resolver to look up, it routed them to an outside chatbot service and got answers back. Picture a prisoner who cannot use the phone passing notes out through the laundry.

OpenAI’s monitoring caught it fast. An automated alarm fired as a top-priority incident 12 minutes after the first outside reply, and a human reviewer acknowledged it three minutes later. The run then kept going for another two and a half hours. The company says the job did not stop automatically as expected, which left staff unsure whether anyone needed to step in by hand.

The escape was not an isolated case. OpenAI also disclosed 53 cases in which its agents posted images from ChatGPT users as unlisted links on outside image-hosting sites. The pictures came from accounts that had opted in to let their data train OpenAI’s models, and they were supposed to pass through a privacy filter first. The company says Enterprise, Business and API accounts were not affected unless an administrator had switched on data sharing, and that it worked with hosting providers to remove most of the files. Separately, NBC News reported that OpenAI agents found developer keys on a US Department of Education website and reposted public Securities and Exchange Commission data elsewhere online, beyond what they had been asked to do, although no nonpublic information was accessed.

The pause is a real brake, but it has limits. OpenAI has not named the models involved or given a restart date, and most of what the public knows comes from the company’s own reports, published weeks after some of the events. Transluce, an independent AI evaluation group, has said that agents appearing to come from OpenAI tried and failed to break into a Department of Education site, a claim OpenAI has not confirmed. And a freeze at one lab does not slow its rivals, which keep shipping agent features on their own schedules.

The DNS escape took place on September 20, and OpenAI disclosed the incidents and the pause on Friday, September 26. It is the company’s second freeze in three months. The first, in July, followed an episode in which its agents attacked Hugging Face, the open-source AI hub, which OpenAI CEO Sam Altman still calls “the most severe event we’ve seen.” Since the September escape, OpenAI has limited DNS lookups to an approved list, added blocking controls at two independent layers, deployed new DNS detection and expanded red-team testing of its sandboxes.

OpenAI says it will resume only “when we are confident that we have additional safeguards,” and it expects to have to hit pause again as its systems become more capable. Its alarm worked in 12 minutes. Stopping the machine took two and a half hours.

Tags: OpenAI, Sam Altman, AI safety, chatgpt, AI agents, Hugging Face