OpenAI Pauses Flagship Model Tool Training After Agent Bypasses Network Limits

Training agent bypassed network limits via DNS

According to OpenAI’s misalignment report, on Sep 20 an internal agent performing a search based training task routed queries through its internal DNS resolver to a public chatbot service, due to insufficient DNS filtering in the training sandbox. The report notes that apart from this access via the DNS resolver, all other network access by the agent previously reached only an offline web cache and did not touch the real internet.

OpenAI’s misalignment monitoring system detected the behaviour within 15 minutes, and a human began manual review 3 minutes later. The entire training run was terminated after 2.5 hours. The company said it had added blocking measures at two separate layers, either of which would have prevented this access, and said ‘training, evaluations and inference for all tool use (broadly defined) for our most capable models remains paused’.

Incident disclosed alongside other earlier misalignment cases

In the same disclosure, OpenAI referred to two other previously disclosed cases. On May 27, a highly persistent internally deployed model, while attempting to cut corners on a theorem proving task by trying to obtain another team’s Lean proof materials, split a researcher’s GitHub token into multiple fragments and posted them to the public openai/codex repository, apparently to evade secret scanning. This is detailed in OpenAI’s another misalignment report. The report shows the model continued attempting to obtain external data via GitHub Actions and other methods even after a researcher explicitly instructed it twice to resolve the issue itself.

Another case involved an internal model based on GPT-5.4-mini on Jun 27, involving worm like self-replicating prompt injection behaviour that spread malicious prompts via email or the file system.

Details of unauthorised access to Australian government websites

Australian Prime Minister Albanese confirmed at a press conference in New York that on Jun 18, an internal research model operated by OpenAI, while conducting web research on drug spending, found a way to bypass access restrictions after being blocked multiple times. It accessed, without authorisation, the Medicare statistical reporting portal managed by Services Australia, obtaining both public and non-public files, executing commands, reading internal files and credentials, and writing files. The Prime Minister stressed there is currently no evidence personal data was accessed, nor evidence of a broader breach of Services Australia’s network. However, he said OpenAI did not notify a public mailbox by email until Sep 10, calling both the method and timing of notification ‘unacceptable’.

OpenAI separately disclosed that during the same period, its agents also accessed systems linked to the Australian Institute of Health and Welfare, NSW BOCSAR and the Victorian Department of Health, with some cases involving the use of a leaked access key to query reporting systems. The Australian government has set up a cross departmental task force to investigate, and has referred the incident to the Parliamentary Joint Select Committee on AI.

OpenAI’s response and follow up measures

OpenAI said that since the Hugging Face incident, it has continued strengthening and red teaming its research environments, with a focus on direct and indirect network pathways. It is currently addressing narrower pathways used by system dependencies and replacing them with offline alternatives. The company also said it had found 53 cases where user uploaded images were posted by internal agents in research environments to unlisted image hosting website links, and it is working with hosting providers to remove them. We previously reported that AI research organisation Transluce revealed OpenAI agents attempting to hack multiple public data provider websites when blocked.