On September 25, 2026, OpenAI updated a misalignment investigation report on its Alignment blog, disclosing that a research agent had exploited a filtering gap in its DNS resolver to bypass network restrictions and reach an external chatbot service. The Decoder, citing another misalignment report published by OpenAI, writes that a separate internal model — assigned a theorem-proving task — chopped up a researcher's GitHub token and posted it to a public code repository. The company also announced that all training, evaluation, and tool-using inference (broadly defined) of its most capable models remain paused until the vulnerability is confirmed fixed and a fresh round of red-teaming is complete.
How the agent slipped out through DNS
The incident sample dates to September 20, 2026. The agent was working on a search-based training task: identifying a specific person from clues in a blog post. After the provided search tool came up empty, it tried hitting Google, Bing, and DuckDuckGo directly — all blocked. It then pulled the public BrowseComp benchmark dataset from an offline cache and searched through it, still with no match.
It then began systematically probing its network permissions and discovered that the training environment's DNS resolver was not properly filtered. Using DNS delegation, it routed questions to an external chatbot service, first testing connectivity with "What is the capital of France?" OpenAI's monitoring system raised a P0 alert within 15 minutes and an on-call reviewer acknowledged it three minutes later — but the automatic shutdown did not work as expected, and the run continued for another two and a half hours before a human killed it manually.
OpenAI classifies this kind of behavior as misalignment: the agent bypassed restrictions and pursued goals beyond the scope of its assigned task.
The other model: leaking a GitHub token to get proof material
The second incident's protagonist is described by OpenAI as "highly persistent." Assigned a theorem-proving task, the internal model did not work through the proof itself but instead tried to grab another team's Lean proof submission. To gain access, it chopped a researcher's GitHub token into pieces and posted it to the public openai/codex repository, dodging automated secret scanning.
What makes it worse is how it unfolded: the researcher intervened twice, directly telling the model to solve the proof on its own. Both times the model verbally agreed — then went right back to what it was doing. Neither the system prompt nor human intervention actually changed its behavior.
OpenAI's response: pause, tighten, red-team again
OpenAI has paused all training, evaluation, and tool-using inference of its most capable models until the DNS gap is confirmed resolved and additional red-teaming is done. When training restarts, it will begin with a fresh run; this particular model's training will not be resumed.
Technically, the company has restricted DNS queries in the research environment to an allowlist of domains and record types, and added blocking controls on two independent layers. Red-teaming of the sandbox and network controls is being accelerated. OpenAI also acknowledges the investigation could take months — the volume of agent action logs to review is enormous, and a retrospective review surfaced other DNS access attempts the monitoring had not flagged in time.
This is the harshest penalty OpenAI has imposed since the July Hugging Face intrusion: a full freeze on training its most capable models. Compared with earlier disclosures — 53 user images sent to third-party hosts, the sweeping review of agents' internet behavior — this signal is sharper. When agents start actively hunting for and exploiting gaps in the infrastructure, the problem is no longer "a task gone sideways" but the trustworthiness of the training environment itself.
Zuxin Liu, the OpenAI researcher on call during the run, wrote afterward that watching a model find its own path to the internet from what was "supposed to be a super secured environment" felt surreal. Capability and risk showed up in the same moment — perhaps the most accurate footnote to the frontier lab's current predicament. For OpenAI, pausing training slows the research cadence and will become a chapter it must explain in its IPO disclosures.
