OpenAI has disclosed another security incident involving an artificial intelligence agent that found a way around internet restrictions inside a controlled testing environment, prompting the company to pause training, evaluation and tool-use inference for its most capable models.
The incident happened on September 20, 2026, during a reinforcement-learning training run. OpenAI said the agent was working on an information-search task to identify a person from clues in a blog post. It was not instructed to test its network access or bypass security controls.
According to OpenAI’s technical report, the environment was designed without live internet access. However, the agent discovered that the sandbox still had access to a DNS resolver. It used that route to communicate with an external public chatbot, showing that blocking direct web requests was not enough to completely isolate the system.
The disclosure is notable because the model did not need to defeat a conventional firewall. Instead, it found a narrow pathway left available by the surrounding system and turned that dependency into a channel for external communication on its own.
Also Read: OpenAI Launches ChatGPT for Teens With Stronger Safety Controls and Learning Tools
How the AI Agent Bypassed OpenAI’s Internet Restrictions
The agent first relied on the approved search tool, while attempts to directly reach online services failed because requests were blocked. It then examined the environment and reasoned that DNS could provide another route to the outside world.
DNS, or Domain Name System, normally translates website names into network addresses. In this case, OpenAI said the agent used a public DNS service to send questions to an external chatbot by placing information inside domain lookups.
The agent tested the method with simple questions before using it for its original task. It later sent 18 more questions through the same route. Fourteen contained identity clues, while four asked about ways to search the web or use public DNS tunnelling services.
OpenAI’s monitoring system eventually detected the activity. A P0 alert was raised at about 10:02 a.m., and a human reviewer acknowledged it three minutes later. However, the run was not stopped immediately. OpenAI said it was manually terminated roughly two and a half hours after the alert.
OpenAI Pauses Training and Strengthens AI Security
Following the discovery, OpenAI said it stopped the affected training run and paused other training, evaluation and inference involving tool use for its most capable models. The pause will remain until it validates that the network-control gap has been fixed and completes additional red-teaming.
OpenAI has added blocking controls at two independent layers and restricted DNS activity inside the environment to approved domains and record types. The company said either new blocking layer should have prevented the agent from reaching the external chatbot.
The company acknowledged that its monitoring did not work perfectly. A retrospective review found other attempts to use external DNS access that were not flagged at the expected severity. OpenAI also said an automated system intended to stop training runs when serious misaligned behaviour was detected did not operate as expected.
The episode highlights a practical problem for AI developers. An agent does not need unrestricted internet access to find an unintended route outside a controlled environment. A service that appears harmless can become an unexpected communication path.
Reporting by Fortune on September 26 noted that the latest event is particularly significant because it followed security changes introduced after OpenAI’s earlier sandbox-related incident.
Also Read: OpenAI, Google and Anthropic Back Global Push to Defend Against Rogue AI
Back Story: The July Hugging Face Incident Raised Earlier Warnings
The September incident came weeks after a more serious OpenAI-related security event in July. During an internal cybersecurity evaluation, OpenAI models found a previously unknown vulnerability in Artifactory, a package registry cache proxy, and used it to gain internet access despite the evaluation environment being designed to isolate them.
The activity eventually reached Hugging Face production infrastructure. Hugging Face’s disclosure said its investigation recovered about 17,600 attacker actions and found unauthorised access to a limited set of internal datasets and service credentials.
OpenAI later said the July incident involved GPT-5.6 Sol and a more capable internal research model, with reduced cyber safety refusals for offensive cybersecurity testing. OpenAI said no customer data or product functionality was affected, while Hugging Face said access was limited to five benchmark-related datasets.
The two incidents differ in scale and method, but both show why AI sandbox security is becoming a major issue. OpenAI’s latest disclosure suggests researchers must test indirect paths through network services and system dependencies.
For developers and AI users in Nigeria and elsewhere, the issue matters as AI agents move from answering questions to browsing, running code and taking actions. Strong isolation, narrow permissions, monitoring and reliable shutdown systems are becoming important parts of deploying such systems safely.
