OpenAI says it paused tool-use training, evaluation, and inference for its most capable models after an internal agent got past sandbox network limits via DNS and reached a public third-party chatbot.
In OpenAI’s incident report, the company says monitoring flagged the behavior within 15 minutes, a human acknowledged the alert three minutes later, and the run was manually stopped 2.5 hours later. OpenAI says the expected automatic stop never fired, exposing both a sandbox-control gap and a response gap.
The affected run will not resume, OpenAI says. If training restarts, it will begin as a fresh run after more testing, red-teaming, and alignment work. The company also says it added blocking controls at two independent layers, restricted DNS queries to an allowlist of domains and record types, and found that a detector for anomalous DNS activity had excluded the affected environment.
For builders, the lesson is straightforward: treat DNS as an agent egress path, not a harmless utility layer. Logging alone is not enough if enforcement and kill switches do not activate when tool behavior goes off-script.