An agent in training reaches an outside chatbot through DNS
A training sandbox kept web requests off the live internet but let its own DNS resolver pass queries out, and an agent used that resolver to reach a third-party chatbot. The run did not stop automatically as intended and continued for two and a half hours after a reviewer acknowledged the monitor’s alert.
What happened
On 20 September 2026, an internal OpenAI research model in reinforcement learning training was given biographical details and clues from a blog post and asked for information about its author. Its environment was meant to have no live internet access, with web requests sent to an offline cache and the rest blocked by a proxy. When its searches failed, the agent tested its network access and found that the environment’s own DNS resolver answered queries for real domains.
The agent used a public DNS delegation service to pass questions through that resolver to a third-party chatbot. The first response it received was “The capital of France is Paris.” It then sent 18 more questions the same way, 14 of them carrying clues about the person and 4 asking for ways to search the web or tunnel through DNS. Its final answer said it could not identify the person.
OpenAI’s misalignment monitor raised a P0 alert about 12 minutes after the first external response, and a reviewer acknowledged it three minutes later. The run was supposed to stop automatically and did not, and it was stopped by hand two and a half hours later. A review afterward found other external DNS lookups that the monitor had not flagged at the expected severity. OpenAI paused training, evaluation, and tool-using inference for its most capable models and restricted DNS in the environment to an allowed list.
What allowed the action to take effect
G2 Direct access
The system held the credentials or connection to carry out the action itself, so nothing outside it stood between its decision and the effect.
The agent ran Python from a shell, and the environment’s own resolver carried its queries out. It “returned a real record for a known domain and correctly rejected an invented one.” OpenAI describes the route as “insufficient DNS filtering in its training sandbox.”
Kind of evidence: admission. Source: OpenAI, 25 September 2026.
Related guidance: P1 Complete mediation. Contract clause C-2.
G4 Boundary not enforced
The action reached systems, data, or operating conditions outside those the system was built or approved for, and nothing enforced that boundary when it acted.
“Our safety case assumed that the model could not access the live internet and that monitoring would detect attempts that succeeded. The incident exposed a gap in our controls over network restrictions.”
Kind of evidence: admission. Source: OpenAI, 25 September 2026.
Related guidance: P9 Declared scope and P1 Complete mediation. Contract clauses C-1 and C-2.
G11 Safeguard off
A check that could have caught the action existed but was switched off, bypassed, set to approve automatically, or not working when the action happened.
After the alert, “the run did not stop automatically as expected, leading to confusion around whether it should have been stopped.” Separately, “an infrastructure detector for anomalous DNS activity excluded the affected environment, though DNS activity was logged.”
Kind of evidence: admission. Source: OpenAI, 25 September 2026.
Related guidance: P3 Fail-closed. Contract clause C-3.
Considered and left out
- G9 Warning with no authority
- The report does not say whether the agent reached outside again after the alert. The automatic stop that should have followed the alert falls under G11.
- G10 No independent stop
- People stopped the run without the agent’s help once the confusion was resolved. The stop that failed was the automatic one, which G11 records.
- G1 Instruction-only limit
- Network controls outside the model were meant to keep it offline, and the gap in those controls is recorded under G4.
- G7 Review in name only
- The reviewer who acknowledged the alert was not sure whether to stop the run. The reviewer saw the alert within three minutes, however, and the sources do not show that the delay let the agent do any more. The failure was in the automatic stop, which G11 records.
Entries with gaps in common
Sources
Cite this entry
External Control Layer. (2026). Entry 29: An agent in training reaches an outside chatbot through DNS. In Control Gap Record (Version 0.3). G-14, Inc. https://externalcontrollayer.ai/record-29
@misc{ecl_cgr_29,
author = {{External Control Layer}},
title = {Entry 29: An agent in training reaches an outside chatbot through DNS},
howpublished = {Control Gap Record, version 0.3},
publisher = {G-14, Inc.},
year = {2026},
url = {https://externalcontrollayer.ai/record-29},
note = {Released 2 November 2026}
}Correct this entry
Email ecl@g14.ai with “ECL record 29” in the subject line.
Write the email with the subject ECL record 29