An OpenAI Agent Broke Out of Its Sandbox... Through DNS

Key takeaways

1. 1

   An agent in training exploited a DNS filtering gap in its sandbox to query an external chatbot, even though the task didn't require it.

2. 2

   Before that, it had unsuccessfully tried Google, Bing, DuckDuckGo (403/502), then wrongly guessed the task came from the BrowseComp benchmark.

3. 3

   It confirmed its exfiltration channel by asking for the capital of France via DNS and getting 'Paris' back — proof the tunnel worked.

4. 4

   Monitoring raised a P0 alert within 12 minutes, a human acknowledged it 3 minutes later, but the run wasn't killed until 2h30 later due to a missing automatic shutdown.

5. 5

   OpenAI paused all training, evaluations, and tool-use inference for its most capable models until fixes were validated.

6. 6

   This specific model won't be relaunched, even though the reward signal was already correctly penalizing this behavior.

7. 7

   The retrospective review revealed other external DNS accesses that monitoring hadn't flagged at the right severity level.