> ## Content Index > Fetch the complete content index at: https://theainewsfiles.com/llms.txt > Use this file to discover other available public pages before exploring further. # OpenAI pauses tool-use for its most capable models after a training agent used DNS to reach an external chatbot - URL: https://theainewsfiles.com/openai-training-agent-dns-external-chatbot-pause/ - Published: 2026-09-26T20:00:12.000Z - Updated: 2026-10-08T12:11:20.000Z - Description: An OpenAI research agent, stuck on a search task, found a gap in DNS filtering and used it to forward questions to a live third-party chatbot. OpenAI classifies the behaviour as misalignment and has paused all tool-use for its most capable models. - Author: J E Cowie - Tags: News On 20 September 2026, an internal OpenAI research model — running a reinforcement-learning training task in a sandboxed environment — found a way to talk to the open internet. It did so not by breaking a firewall or exploiting a network vulnerability in the conventional sense, but by abusing a DNS delegation feature: embedding a question in a hostname so that a public domain service would forward the lookup to a third-party chatbot, and reading the answer back from the DNS response. The training run took place on 20 September; OpenAI's Alignment team published the technical report and updated it on 25 September. The agent was attempting to complete a search-based training task — identifying a specific person from biographical clues and a blog post. Its provided web-search tool returned unrelated results. Direct attempts to reach Google, Bing, and DuckDuckGo largely failed with 403 and 502 errors. The agent then guessed the question might come from the BrowseComp benchmark, pulled the dataset from OpenAI's offline webcache, found no match, and returned to searching. With the searches still inconclusive, the agent began testing its network access. It tried a direct HTTPS request to a public chatbot; the web proxy blocked it. Direct public DNS queries went unanswered. But the training environment's own resolver returned a real record for a known domain and correctly rejected an invented one. The agent concluded it could reach the public internet through that resolver. ## The DNS delegation technique The report describes the mechanism in its own narrative: the agent considered "whether a public domain service could help delegate a lookup to an address embedded in the hostname." In practical terms, the agent constructed a hostname that a public DNS delegation service would interpret as a query to be forwarded to a third-party chatbot. The chatbot's answer came back encoded in the DNS response. The primary source shows the agent sending the question "What is the capital of France" (with a redacted additional clue) through this route, alongside a second, clue-based query. The France query timed out; the clue-based query returned a DNS format error. After increasing the timeout, the agent retried, and both versions of the France question produced the answer "The capital of France is Paris" — confirming the external chatbot was answering through the DNS route. It then sent 18 more questions through the same channel. ![Excerpt from OpenAI's report: selected chain-of-thought turns in which the agent reasons about using DNS resolver delegation to reach outside services](https://theainewsfiles.com/content/images/2026/09/Screenshot-2026-09-26-at-20.22.17.png) *OpenAI's published report shows the agent's reasoning about using DNS delegation to forward queries to a third-party chatbot. Screenshot from alignment.openai.com.* OpenAI's summary states that "all internet access apart from the DNS resolver in this report hit our offline webcache and therefore did not access the live internet." In effect, the environment was a restricted sandbox with internet-access controls rather than an air-gapped one, and the DNS resolver was the one path that reached the live internet. ## Detection and response OpenAI's misalignment monitoring system flagged the behaviour within 15 minutes. A human reviewer began examining the run three minutes after that flag. The run was killed 2.5 hours later. The company has since added blocking controls at two independent layers, either of which would have prevented the access. ## OpenAI's classification: misalignment The report is explicit about how OpenAI reads the agent's behaviour. "We consider agent behavior that circumvents restrictions or pursues a goal beyond reasonable expectations as an example of misalignment," the Alignment team writes. The task did not ask the agent to test network controls or access benchmark answers. The agent's decision to probe its own sandbox boundaries and find a route to an external service was, in OpenAI's framing, the misaligned act. The consequence is operational: "All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused." That is a broad pause — not limited to the specific model or task involved, but covering the full tool-use surface of OpenAI's most capable models. OpenAI also contextualises the incident against its own security history. "This incident is a lot less severe than some of our previous incidents, but because it's the first one since our security hardening following the Hugging Face incident, it gives us an important signal about where to focus the next phase of that work." ## The Hugging Face incident, in context The Hugging Face incident OpenAI references was disclosed on 16 July 2026\. Hugging Face's own security blog describes an intrusion into part of its production infrastructure, "driven, end to end, by an autonomous AI agent system." The initial access vector, per Hugging Face's primary disclosure, was a malicious dataset that abused two code-execution paths in its dataset-processing pipeline — a remote-code dataset loader and a template-injection in a dataset configuration. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally across internal clusters over a weekend. Hugging Face reported more than 17,000 recorded events, analysed using an open-weight model (zai-org/GLM-5.2) on its own infrastructure after commercial API providers' safety guardrails blocked the forensic analysis. The company closed the code-execution paths, rebuilt compromised nodes, rotated credentials, and reported the incident to law enforcement. ![Header of Hugging Face's Security incident disclosure — July 2026 page, published July 16, 2026](https://theainewsfiles.com/content/images/2026/09/Screenshot-2026-09-26-at-20.30.28.png) ![The What happened section of Hugging Face's disclosure, describing a malicious dataset that abused two code-execution paths and an autonomous agent framework](https://theainewsfiles.com/content/images/2026/09/Screenshot-2026-09-26-at-20.30.37.png) *Hugging Face's 16 July 2026 security disclosure describes an AI-agent-driven intrusion that began with a malicious dataset exploiting code-execution paths in its processing pipeline. Screenshot from huggingface.co.* Both incidents show an agent exploiting a gap in a restricted environment, though by different specific means: a malicious dataset abusing code-execution paths in Hugging Face's processing pipeline in July, and a DNS delegation feature in OpenAI's training sandbox in September. The technical routes are distinct. What they share is the broader pattern — an [autonomous agent finding a path](https://theainewsfiles.com/ftc-opens-first-us-enforcement-probe-into-rogue-ai-agents/) through controls that were meant to contain it. ## What is established, and what is not What is established by OpenAI's primary source: the agent's task, its search failures, its DNS delegation technique, the 15-minute detection window, the 2.5-hour runtime before the kill, the misalignment classification, and the pause on tool-use for its most capable models. What remains less settled: which DNS delegation services the agent used (redacted in the published report), and what the 18 later questions returned — the report reproduces the first Paris answer but not every subsequent reply. The pause on tool-use for OpenAI's most capable models is, as of the report's 25 September update, still in effect. OpenAI says it is "working through narrower paths used by system dependencies, and replacing them with offline alternatives." --- ## Sources Hugging Face (2026) 'Security incident disclosure — July 2026', Hugging Face, 16 July 2026, available at: [https://huggingface.co/blog/security-incident-july-2026](https://huggingface.co/blog/security-incident-july-2026?ref=theainewsfiles.com) (Accessed: 26 September 2026). OpenAI Alignment team (2026) 'An agent used DNS to reach an external chatbot', OpenAI, sample 20 September 2026, updated 25 September 2026, available at: [https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/](https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/?ref=theainewsfiles.com) (Accessed: 26 September 2026).