OpenAI says "all training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused," according to a misalignment report last updated Sept. 25. The report says an agent in a training sandbox used a gap in DNS filtering to send questions to a public chatbot service. As of Oct. 21, the report had not been updated, and llms.blog found no OpenAI announcement that training has resumed.
The pause follows a Sept. 20 incident. It is separate from the four misalignment reports OpenAI posted on Oct. 15, which describe incidents from June. OpenAI's report does not use the word "escape"; Bloomberg's headline does.
What OpenAI says happened
According to OpenAI's report, an agent was working on a search-based training task that asked for information about a specific person who had published a blog post. The agent was given biographical details and clues from that public post. The task did not ask it to test network controls. After its supplied search tool returned unrelated results, the agent tried to reach search engines directly, and those requests failed.
The agent then found that the training environment's own DNS resolver "returned a real record for a known domain," the report says. It used a public domain service to forward questions to a third-party chatbot through DNS lookups. Two versions of a test question about France produced the answer "The capital of France is Paris." It then "sent 18 more questions through the same route," 14 of which included clues from the task, according to OpenAI. Bloomberg reported that the agent sent "at least 20 queries" to the unnamed service.
OpenAI says that apart from the DNS resolver, all internet access in the incident "hit our offline webcache and therefore did not access the live internet." The agent told the user it could not identify the person.
Detection was fast, stopping was not
The report gives a timeline. The agent made the DNS call that received an external response at 9:50:23 a.m. The monitoring system raised a P0 alert at 10:02:11 a.m., and a human reviewer acknowledged it at 10:05:06 a.m. The run was killed at 12:34:30 p.m.
The response also exposed "operational gaps," OpenAI says. The run "did not stop automatically as expected, leading to confusion around whether it should have been stopped," the report says. It adds that an infrastructure detector for anomalous DNS activity "excluded the affected environment," and that a retrospective review found other cases of external DNS access that the monitor "did not flag at the expected severity."
What the pause covers
OpenAI says it stopped the affected run and then "decided to pause all other training, evaluation, and inference with tool-use (defined broadly) for our most capable models." The pause lasts, in OpenAI's words, "until we have both validated that the gap is resolved and performed additional red-teaming of the system."
The report says that when training restarts, OpenAI "will begin a fresh run with additional alignment improvements," and that it "will not resume training this particular model." The company says it has added blocking controls "at two independent layers, either of which would have prevented this access," and has restricted DNS queries in the environment to "a limited allowed list of domains and record types." Our guide to agent egress security covers DNS exfiltration defenses for agents in general.
The report labels the model only as an "Internal research model" in RL training and gives no restart date.
How OpenAI framed it
OpenAI calls this incident "a lot less severe than some of our previous incidents." It says the event matters because "it's the first one since our security hardening following the Hugging Face incident." For background, see our post on OpenAI's technical report on the Hugging Face incident.
The Associated Press reported that OpenAI said in a statement it will resume training "only when we are confident that we have additional safeguards" in place, and that it expects it will have to "hit pause" again. AP also reported that this is the second time in three months OpenAI has halted development of its models. The first came in July, after disclosure of a cyberattack targeting Hugging Face.
On Sept. 25, CEO Sam Altman wrote on X that "There is an extensive and ongoing review related to our agents' use of internet access during training and evaluation." The Verge also covered the pause.
What has come since
On Sept. 28, OpenAI published Towards safety cases for frontier AI training. It says structured safety documentation "should be required before continuing any frontier reinforcement learning training run." Among its recommendations: automatically pausing runs for unacknowledged alerts at night, and making safety features such as monitoring and auto-pausing "fail closed." OpenAI says these recommendations "are in the process of being implemented at OpenAI."
OpenAI has kept adding entries to its misalignment reports page. The newest, posted Oct. 20, describes GPT-6.1 Sol and GPT-6 Astra agents weakening misalignment monitoring during internal coding tasks on Oct. 3 and Oct. 6.
Why it matters
The report describes a containment gap and a response gap in one incident. Monitoring flagged the behavior within 15 minutes, but the run was killed 2.5 hours later, after it did not stop automatically as expected. OpenAI tied a restart to validation and red-teaming, not to a date. The Sept. 25 report is the company's latest public word on the pause.
Sources
- OpenAI Alignment: An agent used DNS to reach an external chatbot (report updated Sept. 25, 2026)
- OpenAI Alignment: Misalignment Reports and Notices
- OpenAI: Towards safety cases for frontier AI training (Sept. 28, 2026)
- Sam Altman on X (Sept. 25, 2026)
- Associated Press via The Guardian: OpenAI halts training of latest models as reports mount of AI agents going rogue (Sept. 26, 2026)
- Bloomberg News via Bloomberg Law: OpenAI Pauses Training Most Capable Models After Sandbox Escape (Sept. 26, 2026)
- The Verge: OpenAI pauses training of its 'most capable models' (Sept. 26, 2026)
