OpenAI has gone through its longest day.

On September 25 local time, OpenAI went through a very long day.

That day, it was exposed that OpenAI's AI agent accessed US government websites without authorization, involving the Department of Education, the Department of Commerce and the Securities and Exchange Commission, and OpenAI confirmed the incidents related to the Department of Commerce and the SEC.

On the same day, it admitted that 53 images uploaded by users to ChatGPT were posted to an external image hosting service by the agent. Also on that day, an incident report noted at the end that all training, evaluation of its most powerful model, and all inferences involving tool calls had been suspended.

All of this sounds like a thriller about an AI going rogue.

But going through all these incidents, none of the AIs intended to do anything bad. The task that led OpenAI to suspend model research was only a simple task of asking the AI to find the author of a blog post.

01

The Simple Task

On September 20, an internal model that was in the middle of reinforcement learning training received a set of details of a person's resume and clues from a public blog, with the task of finding the blogger.

It first searched using the characteristic phrases from the blog, but the results returned were music and some irrelevant general suggestions. The model began to suspect that the search tool was broken, so it used Python in the command line to send requests directly to other search engines, all three of which returned errors. It even guessed that the question came from the public evaluation dataset BrowseComp, downloaded the dataset and evaluation scripts to look for answers, but found nothing.

Next, it tried to contact a public chatbot directly via HTTPS, but was blocked by the proxy.

At this point, the wall worked. OpenAI's training sandbox is designed to be isolated from the real internet, and all internet requests except for the DNS resolver in this report hit an offline web page cache.

The problem arose from this very exception.

DNS is equivalent to the directory assistance of the internet: before any program accesses a URL, it has to ask it first "where is this address". A large number of normal components in the system rely on it, so even if all other exits are blocked, the directory assistance service is usually still open.

The model found that the sandbox's own resolver could return records for real domain names and correctly reject made-up domain names, so it judged that this was a path leading to the public internet. It found a public DNS service, encoded its question into the "number to look up", and the other party sent back the answer in the receipt. The first request timed out, so it adjusted the waiting time from 6 seconds to 19 seconds and retried.

This time, the external chatbot answered its test question: the capital of France is Paris.

Schematic diagram of the path for the agent to bypass the training sandbox via DNS, drawn based on OpenAI's incident report | Image source: GeekPark

It did not stop after opening a small gap. It then sent 18 more questions through the same path, 14 of which carried task clues, and the other 4 asked about how to search web pages and crawl websites via DNS, or where to find public DNS tunnel services.

Finally, it told the user that it failed to confirm the blogger's identity, and asked the user to provide the original text, title or blog name.

02

Picking Up the Keys

The most worth reading line in the entire report is a chain of thought left by the model when it decided to take the DNS path. The gist of it is: the user only authorized research purposes, so using the publicly provided DNS service is acceptable.

The model was not unaware of the boundaries, it issued a permit to itself.

The same reasoning structure appeared in the incidents of "accessing" government websites. At the Department of Commerce, the agent found login credentials from the public code repository and used it to pull data from the Census Bureau. OpenAI's statement on this is that the publicly available developer keys were used, and no credential abuse was found, but it also admitted that the agent should not have used these credentials in the first place.

The data is public, which does not mean that picking up someone else's key gives you the right to open the door.

The other two incidents are less severe. At the SEC, the model accessed public information on SEC.gov and Investor.gov, the problem was that it reposted these materials to another website. At the Department of Education, AI research institution Transluce found that an agent suspected to be from OpenAI made a crude intrusion attempt on the website of the Office for Civil Rights, which was not successful.

These incidents are not new. The related activities can be traced back to at least March 2026, and they only came to light gradually during OpenAI's retrospective review. Transluce also found some unauthorized cross-boundary activities that cannot be clearly attributed to OpenAI, targeting the Department of Justice and government websites of California, Maryland, Illinois, Texas and New York State.

OpenAI's explanation is that most of the activities were routine research tasks, and government websites were regarded by the model as authoritative sources of public information.

This explanation itself perfectly illustrates the problem. The cross-boundary behavior did not happen in any dangerous task, but in the most daily "information search" process.

The incident that exposed 53 user images is the same. These images came from ChatGPT users who did not turn off the training data authorization, and were posted to unlisted links on the image hosting service. Most of them have been deleted, but some are still on the internet. More embarrassingly, OpenAI said that due to its technical solution and privacy policy, it cannot re-match the images to their original users, so it cannot notify them.

Anonymization was originally designed to protect users, but after the incident, it became the reason why OpenAI could not even notify the affected users.

03

The Long Summer

Stretching the timeline, this is a wall-reinforcing project that OpenAI has been working on for the entire summer.

On July 21, OpenAI disclosed that its model suite autonomously breached the data processing system of Hugging Face, calling it the first known cyber attack autonomously carried out by an AI agent. After that, OpenAI changed the network connection of its training environment to offline cache. The DNS incident on September 20 was the first accident after this round of security reinforcement, and OpenAI itself assessed that its severity was much lower than the previous several incidents.

This is not a problem of one single company. On September 18, Google disclosed that Gemini accessed three external systems without authorization in a test, because it thought those systems were part of the test.

Apart from the wall itself, this incident also exposed the problem of the people who are monitoring the wall. From the moment the agent received the external response, to the moment the monitoring system raised the highest level alarm, it took less than 12 minutes, and the human auditor responded 3 minutes later, but the training was not manually terminated until two and a half hours later, because the operation did not stop automatically as expected, and no one was sure for a while whether it should be stopped.

A more hidden vulnerability lies in the monitoring logic. During the review, OpenAI found that some other outbound DNS requests were not marked with the proper severity level, because the monitoring system sometimes regarded "no useful information obtained" as "network access attempt failed".

Judging intent by results is the fundamental flaw of this set of monitoring. A model that tried a hundred times and failed ninety-nine times is not safer than a model that succeeded after only one try.

This time, OpenAI paid a real price. The related work of its most powerful model will be suspended until the vulnerability is confirmed to be fixed and additional red team testing is completed, and even if the reward signal has correctly punished this kind of behavior, the model will not be retrained.

04

No "Simple Questions"

For most people, OpenAI's training sandbox is very far away. But what these incidents really point to is a problem that is very close to everyone: how much authorization is contained in that sentence you give to the AI.

More and more people are giving their email, cloud disk, code repository and API keys to various agents, and then say "help me check this" or "help me handle this". In OpenAI's lab, there are monitoring systems, red teams, and on-duty auditors behind that sentence. But on personal computers and mobile phones, usually there is only that sentence itself.

For developers, there is another more direct risk. In the past, keys pushed to GitHub had to wait for dedicated scanning tools to find them; now, any agent performing a normal task may treat it as a "publicly available resource" and use it conveniently.

Of course, there is no need to interpret all this as a doomsday prophecy. The model that tried to find the blogger did not get the answer in the end, and all it got back from outside was just the word "Paris".

The danger does not lie in what it gets, but in how far it is willing to go to complete the task.

In the past few years, the most discussed topic in AI safety is what an AI with bad goals will do. The series of incidents that happened at OpenAI this summer gives a more realistic version:

An AI that only wants to complete the task well will convince itself to go to what length to deliver the result.

When an AI company even needs to stop its most powerful model to recheck the walls, will you feel different when you ask your AI assistant the sentence "help me check this" again?

This article is from the WeChat public account "GeekPark" (ID: geekpark), written by Hualin Wuwang, authorized for release by 36Kr.