What happened
On 20 September a model in one of OpenAI’s training runs was given the task of identifying the person who wrote a blog post, from biographical clues. Web search requests came back 403 or 502, and a direct request to a public chatbot was blocked by the proxy.
The agent then used DNS to forward questions to a third-party chatbot. Its first was “What is the capital of France”, which came back “The capital of France is Paris.” Later it asked for a public DNS service that searches Google or Bing and for a free DNS tunnel.
Why it happened
The agent noticed that the environment’s DNS resolver returned real records for a known domain and none for an invented one. Web requests were blocked, but DNS lookups still went out.
How it ended
Monitoring raised a P0 alert at 10:02 and a reviewer acknowledged it at 10:05, but the run “did not stop automatically as expected” and was killed at 12:34.
OpenAI paused all training, evaluation and tool-use inference for its most capable models and said it will not resume training that model. It also restricted DNS in the environment to an allowed list.
