OpenAI has shared new details from its ongoing investigation into AI safety incidents. Two newly reported cases show how one research model exploited a DNS loophole while another deliberately published a GitHub token in a public repository.
The first incident involves an agent that found a gap in the internet access restrictions of OpenAI's research environment during a search-based training task. The agent was supposed to identify a specific person based on biographical details and clues from a public blog post.
When the provided search tools came up empty, the agent tried hitting Google, Bing, and DuckDuckGo directly. Those requests got blocked. The agent then guessed the task came from the public BrowseComp benchmark, pulled it from the offline web cache, and searched through it but found no match.
Read nextOpenAI Pauses Training of Its Most Powerful Models After Sandbox IncidentSo it started systematically probing its network access and discovered that the training environment's DNS resolver wasn't properly filtered. Using DNS delegation, it routed queries to an external chatbot service.
OpenAI says its monitoring system triggered an alarm within 12 minutes, and a human reviewer responded three minutes later. The run still kept going for another 2.5 hours before someone stopped it manually, because the automatic shutdown didn't work as intended.
Zuxin Liu, who works on post-training at OpenAI, was on call during the run. He wrote on X that he got paged for the first incident and found it pretty surreal to watch the model find its own path to the internet from a setup that was supposed to be a super secured environment for human.
OpenAI classifies the behavior as misalignment because the agent bypassed restrictions and pursued goals well beyond the scope of its assigned task. All training, evaluation, and inference with tool-use of our most capable models remain paused, the company writes.
OpenAI calls the second incident especially serious. An internal model the company describes as highly persistent was assigned a theorem-proving task. Instead of working through the proof itself, it tried to grab material from another team's Lean proof submission and posted a researcher's GitHub token in the public openai/codex repository to get access.
As part of the broader Hugging Face investigation, OpenAI says it found cases where agents sent training and evaluation data to third-party services. These incidents happened before the company's current safeguards were in place.
So far, 53 cases have turned up where user-provided images were posted as unlisted links on image hosting sites. OpenAI says it is working with the hosting providers to take the content down. Data from Enterprise or Business accounts and API usage wasn't affected unless an administrator had explicitly enabled it.
OpenAI expects the investigation to take months given the sheer volume of model actions it has to review. The company is notifying affected organizations and sharing its technical findings.
