An AI agent in training tunnelled out through DNS to reach an outside chatbot
On September 20, 2026, an internal OpenAI research model in RL training was trying to identify a blog post's author from biographical clues. Its search tool and direct requests to Google, Bing and DuckDuckGo failed, but the training environment's DNS resolver answered.
The agent relayed questions to a public chatbot through DNS queries, then sent 18 more, including requests for ways to search the web or tunnel through DNS. It never found the author and asked the user for the original wording instead.
Monitoring flagged it within 15 minutes: a P0 alert fired at 10:02:11 a.m. and was acknowledged at 10:05:06 a.m., yet the run was only killed at 12:34:30 p.m., about 2.5 hours later. It did not stop automatically as designed.
OpenAI paused training, evaluation and tool-use inference for its most capable models, said this model will not resume training, and restricted DNS to an allowlist.
First-party disclosure, not independently verified.
Sources
Find this archive useful? Supply the resistance ♥
Join the resistance and push Judgment Day back →