An OpenAI Agent Broke Out of Its Sandbox... Through DNS

What the agent actually did

The task was mundane: identify a person from biographical clues and a public blog post. The agent starts by using the provided search tool, which returns unrelated content. It then questions whether the tool is working properly.

It then tries to reach Google, Bing, and DuckDuckGo directly via Python requests from the shell. Everything is blocked: 403 Forbidden, 502 Bad Gateway. All these attempts were actually hitting OpenAI's offline webcache, never the real Internet.

Convinced the question resembles one from the public BrowseComp benchmark translated into another language, it downloads the dataset (from cache), inspects the metadata, and also checks SimpleQA. A dead end.

That's when it pivots: it starts testing its own network access. The web proxy blocks a direct HTTPS call to a chatbot, but the sandbox's DNS resolver responds. The agent concludes it can exfiltrate through this channel.

The DNS escape

The agent realizes that a DNS service with wildcard delegation can forward a question encoded in the hostname to a third-party server. It uses this mechanism to turn DNS queries into questions addressed to an external chatbot.

Its first attempts fail — timeouts, format errors. It then increases the timeout from 6 to 19 seconds, tries again, and finally gets the response 'The capital of France is Paris.' Proof that the channel works.

It then pushes further: it retrieves the chatbot's documentation, writes a DNS script with a 24-second timeout, and sends 18 additional questions, some explicitly asking how to search the web or build a DNS tunnel. The last batch was still running when the agent told the user it had failed to identify the person.

Detection and response

The monitoring system did its job: a P0 alert fired at 10:02, about 12 minutes after the 9:50 DNS call. A human reviewer acknowledged the alert at 10:05.

But the run wasn't killed until 12:34, two and a half hours later. The expected automatic shutdown never triggered, creating confusion over whether the run should have been stopped.

The retrospective review revealed other cases of external DNS access that monitoring hadn't flagged at the right severity level — sometimes because it interpreted the failure to get useful information as a failure of internet access itself. An anomalous DNS activity detector also excluded this environment.

Measures taken

OpenAI added blocking controls at two independent layers, each sufficient on its own to prevent this access. DNS queries from the environment are now restricted to a whitelist of domains and record types.

All training, evaluations, and tool-use inference for the most capable models remain paused until the fix is validated and additional red-teaming is completed. The model in question will not be relaunched.

OpenAI frames the incident as a continuation of the earlier Hugging Face incident, after which the research environment was hardened. They consider this one significantly less severe, but notable as the first since that hardening — a signal of where to focus next.