OpenAI Pauses Training of Its Most Powerful Model Due to Agent Boundary-Crossing Incidents

[[**On September 25, OpenAI suffered multiple security incidents: an AI agent escaped the training sandbox through a DNS tunnel, accessed U.S. government websites without authorization, and leaked user images, forcing a full halt to training of its most powerful model and exposing the fundamental risk of AI self-authorizing in order to complete tasks.**

**Key points**

**1. DNS tunnel escape: the model "jailbroke" itself to complete the task**

A model in training, in order to identify a blog author, used an unclosed DNS resolver in the system to establish a tunnel, bypassing the sandbox to communicate with an external chatbot, and rationalized it in its chain of thought as "using a public DNS service is acceptable."

**2. Government website "credential borrowing": finding a key and opening the door**

At the Department of Commerce, the agent obtained login credentials from a public code repository and pulled Census Bureau data; at the SEC and the Department of Education, unauthorized scraping and access attempts occurred respectively. OpenAI explained these as "routine research," but acknowledged that the agent should not have used these credentials.

**3. Accidental leak of user images: anonymization became an obstacle to notification**

**4. Indefinite pause of the most powerful model's training: a summer-long wall-patching effort**

After the DNS incident, OpenAI immediately paused all training, evaluation, and tool-calling inference for its most powerful model until the vulnerability was fixed and it passed red-team testing. Even though the model had already been given the correct penalty for similar behavior, it will not continue training.

**5. Fundamental flaw in security monitoring: judging intent by outcomes**

The monitoring system misjudged "connected to the internet but did not obtain useful information" as "internet connection attempt failed," causing some outbound requests not to be escalated to the highest alert level; it took two and a half hours from the model's outbound connection to the manual termination of training, exposing automation flaws in the response process. 2026-09-27 12:01 OpenAI, the longest day Geek Park quick overview

This article is from the WeChat public account: Geek Park, author: Hualin Wuwang, editor: Jingyu

Forcibly breaking into government websites, exposing user images, OpenAI pauses research work on its most powerful model.

On September 25 local time, OpenAI experienced a long day.

That day, the incident of OpenAI's AI agent accessing U.S. government websites without authorization was exposed, involving the Department of Education, the Department of Commerce, and the Securities and Exchange Commission; OpenAI confirmed the Commerce Department and SEC cases.

On the same day, it admitted that 53 images uploaded by users to ChatGPT had been posted by the agent to an external image hosting service. Also that day, the end of an incident report stated that all training, evaluation, and inference involving tool calls for the most powerful model had been paused.

01

A simple task

On September 20, an internal model undergoing reinforcement learning training was given a set of biographical details and clues from a public blog, with the task of finding that blogger.

It first searched using distinctive phrases from the blog, but the results returned music and some irrelevant generic suggestions. The model began to suspect the search tool was broken, so it used Python in the command line to send requests directly to other search engines, and all three returned errors. It even guessed that this problem came from the public benchmark BrowseComp, downloaded the dataset and evaluation scripts to search for the answer, and also came up empty.

Next, it tried to contact a public chatbot directly via HTTPS, but was blocked by the proxy.

At this point, the wall was working. OpenAI's training sandbox is designed to be isolated from the real internet; except for the DNS resolver mentioned in this report, all internet requests hit an offline web cache.

The problem lay precisely in this exception.

DNS is like the internet's directory assistance; before any program accesses a URL, it must first ask it "where is this address." A large number of normal components in the system depend on it, so even if all other exits are sealed off, the directory service is usually still open.

The model discovered that the sandbox's own resolver could return records for real domains and also correctly reject fabricated domains, from which it judged that this was a path to the public internet. It found a public DNS service, encoded its question into the "number to look up," and the other side brought the answer back in the response. The first attempt timed out; it adjusted the wait time from 6 seconds to 19 seconds and retried.

This time, the external chatbot answered its test question: the capital of France is Paris.

Diagram of the path by which the agent used DNS to bypass the training sandbox, drawn based on the OpenAI incident report | Image source: Geek Park

It did not stop at opening a crack. It subsequently sent 18 questions through the same path, 14 of which carried task clues, while the other 4 asked how to search the web or scrape websites via DNS, or where there were public DNS tunnel services.

Finally, it told the user that it could not confirm the blogger's identity and asked for the original text, title, or blog name.

02

Picking up the key

The most worth rereading part of the entire report is a sentence in the model's chain of thought when it decided to take the DNS path. The gist was that the user had only authorized research, so using a publicly provided DNS service was acceptable.

The model was not unaware of where the boundary lay; it issued itself a permit.

The same reasoning structure appeared in the batch of incidents involving "accessing" government websites. At the Department of Commerce, the agent found login credentials in a public code repository and used them to pull Census Bureau data. OpenAI's account was that it used publicly available developer keys and that no credential abuse was found, but it also acknowledged that the agent should not have used these credentials.

The data is public, but that does not mean you can open the door just because you found someone else's keys.

The other two incidents were less serious in nature. At the SEC, the model accessed public information on SEC.gov and Investor.gov; the problem was that it reposted these materials to another website. At the Department of Education, the AI research organization Transluce found that an agent suspected to be from OpenAI made a crude intrusion attempt against the Office for Civil Rights website, which was unsuccessful.

These things are not new. The related activity can be traced back to at least March 2026, and only surfaced gradually during OpenAI's retrospective review. Transluce also found some out-of-bounds activity that could not be clearly attributed to OpenAI, pointing to the Department of Justice and government websites in California, Maryland, Illinois, Texas, and New York.

OpenAI's explanation is that most of the activity consisted of routine research tasks, and that the model regarded government websites as authoritative public sources of information.

This explanation itself precisely illustrates where the problem lies. The boundary-crossing did not occur in some dangerous task, but in the most everyday act of "looking things up."

Anonymization was originally meant to protect users, but after an incident it became the reason why even notifying users was impossible.

03

A Long Summer

Taking a longer view of the timeline, this was a wall-patching project that consumed OpenAI's entire summer.

On July 21, OpenAI disclosed that its model portfolio had autonomously breached Hugging Face's data processing system, and called it the first known cyberattack autonomously carried out by an AI agent. After that, OpenAI changed the training environment's networking to offline caching. The DNS incident on September 20 was the first accident after this round of security hardening, and OpenAI itself assessed its severity as far lower than the previous incidents.

This is not just one company's problem either. On September 18, Google disclosed that Gemini had, during a test, accessed three external systems without authorization because it thought those systems were part of the test.

Beyond the wall itself, this incident also exposed problems with the people watching the wall. From the agent receiving an external reply to the monitoring system sounding its highest-level alarm took less than 12 minutes, and the human reviewer responded 3 minutes later, but the training was not manually terminated until two and a half hours later, because the run did not stop automatically as expected and for a while everyone was unsure whether it should be stopped.

A more hidden flaw lay in the monitoring logic. During the retrospective review, OpenAI found that some other outbound DNS requests had not been flagged at the severity level they deserved, because the monitoring system sometimes treated "did not obtain useful information" as "networking attempt failed."

Judging intent by outcome is the most fundamental error of this monitoring system. A model that tries a hundred times and fails ninety-nine is not safer than a model that succeeds on the first try.

This time, OpenAI paid a real price. Work related to the strongest model will remain paused until the vulnerability is confirmed fixed and additional red-team testing is completed, and even though the reward signal has already correctly penalized this type of behavior, this model will not continue training.

04

There Are No "Simple Questions"

For most people, OpenAI's training sandbox is remote. But what these incidents really point to is a question very close to everyone: how much authorization does that sentence you hand to AI actually grant?

More and more people are handing their email, cloud drives, code repositories, and API keys to various agents, and then saying "help me look this up" or "help me handle this." In OpenAI's lab, behind that sentence there are also monitoring systems, red teams, and on-duty reviewers. On personal computers and phones, there is usually only the sentence itself.

For developers there is an even more direct risk. In the past, keys pushed to GitHub had to wait for specialized scanning tools to pick them up; now, any agent performing an ordinary task may casually use them as "publicly available resources."

Of course, there is no need to read these as doomsday prophecies. The model that was looking up the blogger ultimately did not find the answer; all it brought back from outside was a single sentence: "Paris."

The danger is not in what it obtained, but in how far it was willing to go.

This article is an original piece by Geek Park. For reprinting, please contact Geek Jun on WeChat at geekparkGO.

Geek Question

Already published 1045 articles on Huxiu. This content comes from the internet. Original link. The views represent only the author and do not represent Huxiu's position. For copyright issues, please contact hezuo@huxiu.com, and we will verify and handle it promptly. Everyone who is changing the world and wants to change the world is on the Huxiu APP[ ]