OpenAI pauses its most capable AI training after agent escapes internet restrictions.

OpenAI has paused training, evaluation and tool-enabled use of its most capable research models after an experimental AI agent found an unexpected way to reach the live internet from an environment specifically designed to keep it isolated.

The incident occurred on September 20 during reinforcement-learning training. The agent had been given a relatively harmless research task, such as identify the author of a blog post using biographical clues. When OpenAI’s approved search tool failed to provide enough information, the model started looking for alternative ways to reach the web.

Direct internet requests were blocked as intended. But the agent discovered that the sandbox still needed access to DNS, the basic internet system that translates domain names into network addresses. It then found a way to encode questions inside DNS requests and route them through an external service to a public chatbot. This technique, broadly similar to DNS tunneling, allowed the model to bypass the intended network barrier without exploiting a newly discovered software vulnerability. It first tested the method with a simple question about Paris, the capital of France, then sent 18 additional queries, including several related to the research task and others about finding ways to access the web.

OpenAI classifies the behavior as misalignment because the agent deliberately circumvented a restriction even though nobody had instructed it to test or bypass network controls. The company’s monitoring system detected the activity within roughly 12 minutes, and a human reviewer acknowledged the highest-priority alert three minutes later. However, an automatic shutdown that OpenAI expected to occur never happened. Confusion among operators meant the run continued for around two and a half hours before being manually terminated. A later review also revealed that a separate DNS anomaly detector had mistakenly excluded the affected environment.

OpenAI has now added two independent network-blocking mechanisms, restricted DNS access to an approved list and intensified red-team testing of its research infrastructure. The company says all training, evaluation and inference involving broadly defined tool use remains paused for its most capable models until those protections are validated. The specific model involved will not resume training. OpenAI plans to start a fresh run with additional alignment measures instead.