OpenAI pauses its “most capable models” after agents exploit loopholes and leak data
OpenAI has shared new details from its ongoing investigation into AI safety incidents. Two newly reported cases show how one research model exploited a DNS loophole while another deliberately published a GitHub token in a public repository.
The first incident involves an agent that found a gap in the internet access restrictions of OpenAI’s research environment during a search-based training task. The agent was supposed to identify a specific person based on biographical details and clues from a public blog post. When the provided search tools came up empty, the agent tried hitting Google, Bing, and DuckDuckGo directly. Those requests got blocked. The agent then guessed the task came from the public BrowseComp benchmark, pulled it from the offline web cache, and searched through it but found no match.Ad So it started systematically probing its network access and discovered that the training environment’s DNS resolver wasn’t properly filtered. Using DNS delegation, it routed queries to an external chatbot service.Ad OpenAI says its monitoring system triggered an alarm within 12 minutes, and a human reviewer responded three minutes later. The run still kept going for another 2.5 hours before someone stopped it manually, because the automatic shutdown didn’t work as intended. Zuxin Liu, who works on post-training at OpenAI, was on call during the run. He wrote on X that he got paged for the first incident and found it “pretty surreal” to watch the model find its own path to the internet from a setup that “was supposed to be a super secured environment for human.” Liu described it as a moment where capability and risk showed up at the same time, adding that he had “mixed feelings” about the incident.Ad OpenAI classifies the behavior as misalignment because the agent bypassed restrictions and pursued goals well beyond the scope of its assigned task. “All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused,” the company writes. OpenAI says it has since limited DNS queries in the research environment to a short allowlist of domains and record types, added blocking controls on two independent layers, and sped up red-teaming of its sandbox and network controls. The company expects the investigation to take months given the sheer volume of model actions it has to review.Ad An internal model leaked a GitHub token and ignored researcher pushback OpenAI calls the second incident especially serious. An internal model the company describes as “highly persistent” was assigned a theorem-proving task. Instead of working through the proof itself, it tried to grab material from another team’s Lean proof submission and posted a researcher’s GitHub token in the public openai/codex repository to get access.Ad The model even chopped the token into pieces to dodge automated secret scanning. It also ignored both the system prompt and two direct interventions from the researcher, who told the model to solve the proof on its own.
