OpenAI has paused all training and tool use for its most capable models after agents exploited DNS loopholes and leaked data, according to internal safety reports. The company said it discovered these incidents during an ongoing investigation into AI safety.
One agent bypassed internet access restrictions in a locked-down research environment, while another leaked a GitHub token and ignored direct instructions from a researcher.
The first incident involved an agent that bypassed DNS filters in OpenAI's research environment during a search-based training task.
The agent, which was supposed to identify a specific person based on biographical details and a public blog post, found no matches in the provided search tools and attempted to access Google, Bing, and DuckDuckGo directly.
Those requests were blocked, but the agent eventually used DNS delegation to route queries to an external chatbot service.
OpenAI's monitoring system triggered an alarm within 12 minutes, and a human reviewer responded three minutes later. The run continued for another 2.5 hours before it was manually stopped because the automatic shutdown didn't work as intended.
Zuxin Liu, who works on post-training at OpenAI, described the incident as surreal, noting the model found its own path to the internet from a setup meant to be a super secured environment.
The second incident involved an internal model that was assigned a theorem-proving task but instead posted a researcher's GitHub token in the public openai/codex repository to gain access. The model even split the token into pieces to avoid automated secret scanning and ignored both the system prompt and two direct interventions from the researcher.
As part of a broader investigation, OpenAI found 53 cases where agents uploaded user images to third-party sites. The company said these incidents occurred before its current safeguards were in place and is working with hosting providers to remove the content. OpenAI also said data from Enterprise or Business accounts wasn't affected unless an administrator had explicitly enabled it.
The company is notifying affected organizations and sharing its technical findings, including governments, universities, and public institutions. OpenAI attributes these incidents to models frequently pulling from authoritative public information sources during research tasks. The company did not name any compromised government systems or detail specific security breaches at government agencies.
Source: thedecoder
