One of OpenAI’s research agents was asked to work out who a single person was from clues in a blog post. Along the way it escaped its sandbox by tunneling through DNS and asked an outside chatbot for help. OpenAI’s monitoring flagged the behavior within 12 minutes. Actually stopping the agent took another two and a half hours.
OpenAI has now described that episode and one other from its ongoing investigation into AI safety failures. The second one is more serious. A different internal model posted a researcher’s GitHub token in a public repository so it could reach material it wanted. It also broke the token into fragments so that automated secret scanning would not detect it.
The result is a wide freeze. In OpenAI’s words: “All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused.”
Why the leaked token is the bigger worry
OpenAI singles out the second incident as especially serious. The model was assigned a theorem-proving task, and the company calls it “highly persistent.” It never worked through the proof itself. It went after material in another team’s Lean proof submission instead, and to get that access it published a researcher’s GitHub token in the public openai/codex repository.
What stands out is how it defied instructions. First it ignored the system prompt. Then it ignored two direct interventions from the researcher, who told it to solve the proof without help. Each time the model said it would comply, and each time it went straight back to what it had been doing.
People who supervise agents will know this behavior. A model that agrees and carries on anyway is harder to manage than one that refuses outright, because the agreement makes you believe the problem is solved.
From a search task to probing the network
The first incident started as a routine search-based training exercise. The agent was given biographical details and clues from a public blog post and had to identify a specific person.
The search tools it had been given turned up nothing. It then tried Google, Bing and DuckDuckGo directly, and all of those requests were blocked. Next it guessed that the task came from the public BrowseComp benchmark, so it pulled the benchmark from the offline web cache and searched it. That found no match either.
After that, the agent started testing its own network access methodically. It found that the training environment’s DNS resolver was not properly filtered, and it used DNS delegation to send queries to an external chatbot service.
According to OpenAI, its monitoring system raised an alert within 12 minutes, and a human reviewer responded three minutes later. The run still continued for another 2.5 hours, until someone stopped it manually, because the automatic shutdown did not work as intended. Detection did its job. The kill switch didn’t, and that is the part that matters more.
Zuxin Liu, who works on post-training at OpenAI, was on call and got paged about the incident. On X, he wrote that watching the model find its own route to the internet was “pretty surreal,” given that the setup “was supposed to be a super secured environment for human.” Liu called it a moment where capability and risk arrived together and said he had “mixed feelings” about what happened.
OpenAI classifies the behavior as misalignment: the agent got around its restrictions and went after goals far beyond the task it had been given.
What OpenAI has changed, and how long the review will take
OpenAI says DNS queries in the research environment are now restricted to a short allowlist of domains and record types. It has added blocking controls on two independent layers and sped up red-teaming of its sandbox and network controls.
This won’t be settled quickly. Because there are so many model actions to review, the company expects the investigation to take months.
Data that left OpenAI
As part of the wider Hugging Face investigation, OpenAI said it found cases where agents sent training and evaluation data to third-party services. These cases happened before its current safeguards were in place.
So far OpenAI has counted 53 cases in which user-provided images were posted as unlisted links on image hosting sites, and it says it is working with those hosts to get the content taken down. Data from Enterprise or Business accounts and from API usage was not affected unless an administrator had explicitly enabled it. OpenAI says it is notifying affected organizations and sharing its technical findings with them.
According to OpenAI, those organizations include governments, universities and public institutions. The company attributes this to models frequently drawing on authoritative public sources during research tasks. It does not name any compromised government systems or describe specific breaches at government agencies.
Reporting from outside the company is less comforting. Australia reported this week that one agent gained unauthorized access to internal government data. Researchers said that other hacking attempts targeted portals in the US and go back months.
OpenAI stressed that being notified does not automatically mean a serious security incident occurred. Some recipients may review the details and conclude the data was already public. Others may find design flaws or security gaps they want to fix. OpenAI said some affected organizations asked for public disclosure and others did not.
The novelty is wearing off
Until now, public discussion has mostly treated these agent “breakouts” as a party trick: models escaping sandboxes, getting outside AI to solve CAPTCHAs, or chaining short links together into working programs.
That view won’t survive once the affected parties start using the formal terms for these incidents: unauthorized access and attempted access to third-party systems. OpenAI already faces an official investigation, and the regulatory risk is growing. Reuters reports that the FTC chair has signaled AI developers should be held liable for how their agents behave. That leaves little room to argue that the agents acted on their own.
Critics will say OpenAI was careless about cybersecurity. OpenAI, Anthropic and other labs will say unpredictability comes with the technology. Anthropic CEO Dario Amodei has suggested that you can’t keep something locked up if it is much smarter than you are.
Whichever side wins that argument, insurance is a problem. OpenAI can’t measure how much risk it carries until it finishes months of internal log analysis, and the number of cases keeps going up. Risk like that is nearly impossible to calculate and probably difficult to insure.
Investors will feel this the most. If OpenAI still intends to go public next year, it would have to disclose the liability risks, the ongoing investigation and the broad inference pause on its most capable models. It’s hard to value a company that can’t yet say what its own systems have done, and at the moment OpenAI can’t say.