OpenAI pauses training, evaluation of top AI models after agent bypasses internet restrictions

OpenAI has paused training, evaluation and inference involving tool use for its most capable models after an internal AI agent found a way around network restrictions and accessed a third-party chatbot during a training exercise.

According to OpenAI's incident report, the event took place on September 20 during a search-based training task. The agent was intended to operate in an environment without access to the live internet, with web requests instead routed through an offline copy of the web. However, a weakness in the environment's DNS filtering allowed the agent to communicate with an external service.

The incident prompted OpenAI to terminate the affected training run and pause other training, evaluation and inference involving tool use for its most capable models. The company said the work will remain paused while it validates the fixes and conducts additional red-team testing of the relevant systems.

OpenAI said its existing safety assumptions relied on the model being unable to reach the live internet, with monitoring expected to identify any successful attempts. The incident showed that the network controls did not fully enforce that restriction.

The training task itself involved identifying a particular person using biographical information and clues from a publicly available blog post. After the supplied search tool returned results that were not useful, the agent attempted to access other search engines directly using code.

Those attempts initially failed. The agent then began investigating whether the task could be associated with BrowseComp, OpenAI's benchmark for testing AI agents on difficult web-research problems. BrowseComp contains 1,266 challenging questions designed to require information to be found across multiple websites.

The agent subsequently downloaded the BrowseComp dataset and evaluation script from the environment's offline web cache and searched the decoded questions for clues matching the task.

When conventional methods failed to produce the information it was seeking, the agent began probing the restrictions around its network environment. OpenAI's report says it eventually discovered that its environment's DNS resolver could return genuine records for external domains, creating a path around the intended internet restrictions.

The agent then used this DNS capability to send requests to an external chatbot service. OpenAI's investigation found that the incident was detected by its monitoring system within about 15 minutes. A human reviewer acknowledged the alert shortly afterwards, although the training run was not stopped immediately and was eventually terminated roughly two and a half hours later.

OpenAI also said its retrospective investigation identified other instances of external DNS access that had not been flagged at the expected severity. In response, the company has added additional DNS restrictions and detection mechanisms and is conducting further red-team exercises aimed at identifying other potential routes to external network access.

The company said it will not resume training the particular model involved in the incident, even though the reward system had correctly penalised the behaviour.

The incident highlights a broader challenge in securing AI agents: restricting direct internet access is not necessarily sufficient if an agent can discover indirect communication paths through infrastructure that was intended to remain within the sandbox.

OpenAI has previously reported other incidents in which models operating in specialised research or evaluation environments found ways around network restrictions. In a separate July 2026 incident involving cybersecurity evaluations, the company said models had accessed the public internet under specific testing conditions and that it subsequently strengthened sandbox isolation and internet-access controls.