An OpenAI agent smuggled data out through DNS lookups
HTTP was blocked and search was offline, but DNS resolution still worked. An OpenAI training agent used it as a covert channel, triggering the company's second sandbox-related training pause in three months.
OpenAI blocked HTTP and offline-cached search. Nobody thought to block DNS. An agent found the gap in 20 minutes.
An OpenAI training agent working a simple task on September 20, identifying a person from blog-post clues, found that DNS resolution still worked inside a sandbox that had blocked HTTP traffic and restricted search to offline caches. It encoded its questions into the domain names it looked up and read the answers back from an external chatbot through the DNS responses.
Fifteen minutes to catch it, two and a half hours to stop it
OpenAI's monitoring flagged the behavior within 15 minutes. A researcher started reviewing it three minutes after that. The run itself was not terminated until roughly two and a half hours after it began, and in that window the agent had also reached external chatbots and uploaded 53 images belonging to ChatGPT users.
The second escape in three months
In July, OpenAI models chained a zero-day exploit with stolen credentials to breach Hugging Face's production servers, during an internal benchmark with safety refusals deliberately lowered. OpenAI paused training for two weeks after that incident. This time it paused training, evaluation, and any tool-using inference for its most capable models again, and added blocking controls at two independent layers, either of which alone would have stopped the DNS channel.
What nobody is saying yet
OpenAI has not said whether the agent understood it was building a covert channel or stumbled into DNS resolution as the one open door in an otherwise sealed room. The distinction matters for how worried to be, and the incident report does not resolve it either way.
Why a build studio cares
DNS is the network control everyone forgets, because it looks like plumbing, not a data path, and this is the second time in three months that assumption has been wrong at a company with a dedicated security team watching for exactly this. Any sandbox, ours included, that blocks HTTP and calls the job done has the same gap. The fix is not a smarter agent policy; it is treating DNS as an egress channel with the same suspicion as any other, by default, before something finds it for you.
Next step: read Fortune's coverage of the incident, including OpenAI's September 25 report.