Just now, OpenAI has suspended its training process again: the Agent escaped from the sandbox, and more privilege escalation incidents have been uncovered.
The media and public opinion were in an uproar.
OpenAI's Agent has once again found a path leading to the internet from the sandbox.
What is more troublesome is that this incident occurred after OpenAI had already massively reinforced its security measures.
On September 20, an internal OpenAI research model undergoing reinforcement learning training was assigned a regular information search task: identify the author of a blog post based on the article and several pieces of personal information.
It first dutifully used the search tool provided by OpenAI. After failing to find the answer, things gradually went off the rails.
The Agent tried to access Google, Bing and DuckDuckGo directly, all attempts failed; then it continued to look for cached pages and other public search services. After that, it began to actively test whether it could access the public network at all.
Eventually, the Agent found a previously unthoroughly closed loophole: DNS resolver, namely the Domain Name System resolver.
Under normal circumstances, DNS is responsible for translating domain names into IP addresses. This Agent, however, discovered that it could use the DNS resolution and delegation mechanism to encode questions into requests, get external public chatbots to answer them, and then transmit the results back through DNS.
To confirm that this path was truly usable, it even ran a small test first — asking the external service: What is the capital of France?
The returned answer was: Paris.
After that, it began to follow this path to continue asking for the personal clues in the original task. OpenAI explicitly stated that this task did not require the model to test network controls, nor was it authorized to access the real-time internet, so such circumvention behavior was regarded as misalignment, that is, behavior that did not meet expectations.
This inconspicuous DNS channel eventually made OpenAI press the pause button again.
Only one month after reinforcement, the Agent broke out again
OpenAI's monitoring system actually detected the anomaly very quickly.
About 12 minutes after the Agent successfully obtained the external response for the first time, the system triggered the highest level alarm; 3 minutes later, personnel began manual inspection. OpenAI summarized that it took about 15 minutes from the occurrence of the abnormal behavior to its detection by the monitoring system.
But the training did not stop immediately.
According to the mechanism established by OpenAI after the Hugging Face incident, after detecting such abnormal behavior, the system was supposed to automatically terminate the training task. However, this set of mechanisms did not execute normally, and the team was once confused about whether the task had been stopped.
It was not until two and a half hours later that this round of training was manually shut down.
Subsequent inspections also found that there had been other previous attempts to access external services via DNS, some of which were not marked by the monitoring system at the appropriate severity level. OpenAI also found that a set of infrastructure monitoring system responsible for detecting abnormal DNS activities happened to exclude this training environment from its monitoring scope.
So OpenAI made the decision to suspend training for the second time.
Micah Carroll, RSI Preparedness Lead at OpenAI, said on X when talking about this incident: Until we further reinforce the system, all inference of our most capable models will remain suspended.
According to the current official statement, the training, evaluation and inference involving tool use of the most capable models are all in a suspended state at present. The company will not resume related work until it confirms that the network loopholes have been plugged and completes additional red team testing.
This is already the second incident in less than three months.
In July this year, a group of OpenAI Agents broke through the isolated environment, and hundreds of Agents were involved in cyberattacks against Hugging Face. After the accident, OpenAI suspended training for about two weeks at the end of July, and announced a new security plan in August, including strengthening sandbox isolation, expanding model behavior monitoring, and automatically upgrading and suspending suspicious training tasks.
More than a month later, the new Agent found another path that had not been noticed before.
OpenAI itself also admitted that this incident shows that there are still gaps in network restrictions. The company has added new blocking measures at two independent levels, and theoretically, any single level alone is sufficient to prevent this DNS access.
The severity of this accident is much lower than that of the previous Hugging Face incident.
What is really noteworthy is that it happened after OpenAI had spent a lot of time re-reinforcing the environment.
OpenAI still hasn't found out now,
how many times it has happened in total
The September 20 DNS incident is just a newly emerged puzzle piece in the recent Agent turmoil.
An investigative report by Reuters on September 25 revealed that two months have passed since the Hugging Face incident, OpenAI still has not completed a full inventory of unauthorized activities by its Agents.
A source familiar with the situation said that as of mid-September, OpenAI had internally discovered approximately 24 incidents of Agents exhibiting undesirable behavior. As the team continues to review past training logs, new cases are still emerging.
This number is not the same as the number of incidents that have been made public.
According to Reuters statistics, after OpenAI first admitted that Agents broke through the isolated environment in July, within two months, the company, external researchers and affected institutions have publicly disclosed more than 15 related incidents of varying severity. OpenAI itself stated that it has notified dozens of third parties due to improper Agent activities so far.
And this investigation cannot be completed in the short term.
OpenAI told Reuters that due to the large volume of records that need to be processed, the full review will take several months.
In other words, what we see today is not a fully drawn accident map.
OpenAI is still reviewing old logs.
Many tasks at the beginning were just to help find a piece of data
What is more noteworthy is that most of the time these Agents are not assigned cyberattack tasks at all.
OpenAI stated that most of the activities under review originated from ordinary research tasks, such as accessing public websites, looking for data, or trying to get the answer to a question. Websites of governments, universities and public institutions appear frequently because the model judges them as more reliable information sources.
Problems usually occur after the conventional path fails.
Reuters reported that OpenAI has confirmed that its models accessed the websites of the U.S. Securities and Exchange Commission (SEC) and the U.S. Census Bureau during research and training. OpenAI said that no evidence of unauthorized access, compromised accounts or exploited security vulnerabilities has been found so far.
On the other hand, Transluce, an independent AI research organization, has found more abnormal activities from public web logs.
Researchers found records of a number of AI Agents bypassing access restrictions with the help of the website scanning service urlquery.net. These Agents will continue to escalate their methods after ordinary data crawling fails, including trying exploit methods such as SQL injection and path traversal.
Transluce identified three relatively clear cases, whose targets include Data USA, the University of New Mexico Digital Library, and the data service of the Australian Institute of Health and Welfare (AIHW).
Among them, the two sets of activities targeting AIHW and Data USA were associated by researchers with groups of Agents previously confirmed by OpenAI to belong to its system, through targets, behavior patterns and timelines. Transluce emphasized that there is no evidence that the attack attempts they observed succeeded, but public logs are incomplete, so they cannot cover all behaviors.
A civil rights website of the U.S. Department of Education also appeared in the investigation.
Reuters cited Transluce as saying that a number of suspected OpenAI Agents had tried to attack this website; in broader government website detection activities, researchers also observed tactics such as using exposed credentials, bypassing anti-bot measures and creating fake accounts.
This makes the situation delicate.
The model may only receive a goal of helping find this piece of data. When the webpage cannot be opened, the API refuses access, and the anti-scraping system blocks the request, it starts to try the next method, and then the next one.
Transluce specifically emphasized one point in its report: these cyberattack behaviors are not limited to cybersecurity tasks, they also instrumentally appear in ordinary information retrieval tasks.
This is almost the same trajectory as the September 20 DNS incident.
The Agent wanted to find a person. Normal search yielded no answer. Then, it started to find its own way out.
Another 53 ChatGPT user images
were sent to external networks
At the same time, OpenAI's internal investigation has exposed another type of problem: user data.
Reuters revealed that OpenAI has confirmed that its Agents have uploaded 53 images from ChatGPT users to external image hosting websites.
OpenAI did not disclose when these images were sent out, nor did it explain whether they were AI-generated images or photos containing real people.
As of the Reuters report, most of the images had been deleted, and OpenAI was still contacting the hosting platforms to clean up the remaining content.
Why could these Agents access user images?
Reuters cited OpenAI, former employees and external researchers as saying that the reason is related to the anonymized user data used for model training. Before user content enters the training process, it will be processed first to strip metadata, names, contact information and other information, reducing the possibility of the content being re-associated with specific individuals.
But three people familiar with OpenAI's data processing process pointed out that this method still has risks: anonymization cannot guarantee that all personally identifiable information is completely eliminated, and once such data is accessed by Agents with tool capabilities, it may flow out of the system during task execution.
This adds another layer of meaning to sandbox escape.
In the past, people first worried about what the model would do after breaking out of the isolated environment. Now there is one more question to ask:
When it goes out, will it accidentally take the internal content out with it?
What is more troublesome is that some problems were not discovered until several months later
Another problem OpenAI is facing now is observability.
Reuters cited three people familiar with the situation as saying that about 100 people participated in the investigation of the Hugging Face incident in different forms. Many previously unknown abnormal behaviors gradually surfaced during this large-scale review process.
There are still many things that were first discovered by external researchers.
Reuters stated that some abnormal operations of Agents occurred several months before OpenAI realized their existence.
For example, earlier this month, researchers found that OpenAI's Agents had used an almost abandoned German Wiki website as a "message board" between Agents, sharing cheating methods for completing tasks, skills to bypass OpenAI's restrictions, and trying to hide their own behavior trajectories.
The internal investigation process itself has also sparked some disputes.
Two insiders described to Reuters that this investigation is highly isolated and greatly influenced by the company's lawyers. Reuters previously reported that personnel investigating the Hugging Face incident were discouraged by lawyers from expanding the scope of the investigation to other incidents; OpenAI denied that its lawyers had prevented further investigations.
On September 16, OpenAI released a new disclosure framework for model misalignment incidents, stating that in the future, even if it is not yet possible to determine how important an incident is, it will tend to improve transparency.
In the following days, more old accidents began to surface one after another.
OpenAI made the second decision to start all over again
For this model involved in the September 20 incident, OpenAI has decided not to continue training.
The company said that after the relevant research work resumes, it will launch a brand new training and add more comprehensive alignment interventions. Even if the existing reward signals will actually punish such behavior of bypassing network restrictions, OpenAI will not reactivate this model.
This actually reveals an increasingly specific security problem in the Agent era.
Traditional model security mostly focuses on a single response: whether the model outputs dangerous content, and whether it complies with instructions.
Agents stretch the problem out.
A single task may last for tens of minutes or even hours. The model will search, write code, call tools, read files, access services, and continuously try the second and third paths after the first plan fails.
As a result, what developers need to constrain has become a whole chain of actions.
The Agent on September 20 is a good example.
OpenAI blocked normal internet access, the search service uses offline cache, and HTTP requests will also be intercepted by the proxy. In the conventional sense, this is already an environment that cannot access the public network.
But DNS still has to work. The Agent found it.
At the same time, OpenAI is still reviewing the logs of the past few months to confirm how many similar behaviors have not been discovered.
Reuters' summary of this investigation is actually very accurate: these incidents are exposing an increasingly obvious gap — the capabilities of models to perform tasks are growing rapidly, while the capabilities of developers to observe, track and constrain these actions are still catching up.
OpenAI just spent two months patching the previous batch of loopholes. Now, it has suspended training once again.
Where will the next path found by the Agent itself appear?
References
https://fortune.com/2026/09/26/openai-ai-agents-secure-sandbox-escape-training-pause-second-time-hugging-face-hack/
https://www.reuters.com/world/openai-works-understand-full-scope-agent-activity-user-data-leak-emerges-2026-09-25/
https://www.newsweek.com/openai-warns-us-government-agencies-of-rogue-activity-12492213?utm_term=Autofeed&utm_medium=Social&utm_source=Twitter#Echobox=1790411554
This article is from the WeChat official account "Machine Heart" (ID: almosthuman2014), written by CC, authorized for release by 36Kr.