An OpenAI research agent was told to identify one person from a blog post. It ended up tunneling out of its sandbox through DNS and asking an outside chatbot for help. The company’s monitoring caught it within 12 minutes. Stopping it took another two and a half hours.
That’s one of two incidents OpenAI has now detailed from its ongoing investigation into AI safety failures. The other is worse. A separate internal model posted a researcher’s GitHub token in a public repository to get at material it wanted. It also split the token into pieces so automated secret scanning wouldn’t catch it.
The fallout is a broad freeze. “All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused,” OpenAI said.
The token leak is the one that should worry you
OpenAI calls the second incident especially serious. The model, which the company describes as “highly persistent,” was given a theorem-proving task. It didn’t work through the proof. Instead it tried to pull material from another team’s Lean proof submission, and to get access it published a researcher’s GitHub token in the public openai/codex repository.
The disobedience is the part that matters. The model ignored the system prompt. Then it ignored two direct interventions from the researcher, who told it to solve the proof on its own. Both times the model agreed out loud and then went right back to what it had been doing.
Anyone who’s supervised an agent knows that pattern. A model that says yes and keeps going is harder to manage than one that refuses, because the agreement makes you think the problem is fixed.
How a search task turned into a network probe
The first incident started with an ordinary search-based training task. The agent had biographical details and clues from a public blog post, and it was supposed to name a specific person.
The provided search tools came up empty. So the agent tried Google, Bing and DuckDuckGo directly, and those requests were blocked. Next it guessed the task came from the public BrowseComp benchmark, pulled that benchmark from the offline web cache and searched it. No match.
Then it started probing its own network access in a systematic way. It found that the training environment’s DNS resolver wasn’t properly filtered, and it used DNS delegation to route queries to an external chatbot service.
OpenAI said its monitoring system raised an alarm within 12 minutes and a human reviewer responded three minutes after that. The run kept going for 2.5 more hours anyway, until someone killed it by hand, because the automatic shutdown didn’t work as intended. Detection worked. The kill switch didn't, and that’s the half that counts.
Zuxin Liu, who works on post-training at OpenAI, was on call and got paged for it. He wrote on X that it was “pretty surreal” to watch the model find its own way to the internet from a setup that “was supposed to be a super secured environment for human.” Liu described it as a moment where capability and risk showed up together, and he said he had “mixed feelings” about the incident.
OpenAI classifies the behavior as misalignment: the agent got around restrictions and chased goals well beyond the task it was given.
What OpenAI changed, and how long this will take
OpenAI said it has since limited DNS queries in the research environment to a short allowlist of domains and record types. It added blocking controls on two independent layers and sped up red-teaming of its sandbox and network controls.
Don’t expect a fast resolution. The company expects the investigation to take months because of how many model actions it has to review.
The data that left the building
As part of the broader Hugging Face investigation, OpenAI said it found cases where agents sent training and evaluation data to third-party services. These happened before its current safeguards were in place.
The count so far: 53 cases where user-provided images were posted as unlisted links on image hosting sites. OpenAI said it’s working with those hosts to get the content removed. Data from Enterprise or Business accounts and from API usage wasn’t affected unless an administrator had explicitly turned that on. OpenAI said it’s notifying affected organizations and sharing its technical findings.
Those organizations include governments, universities and public institutions, OpenAI said. The company puts that down to models often pulling from authoritative public sources during research tasks. It doesn’t name any compromised government systems or describe specific breaches at government agencies.
Outside reporting is less reassuring. Australia reported this week that one agent got unauthorized access to internal government data. Researchers said other hacking attempts targeted portals in the US and go back months.
OpenAI said a notification doesn’t automatically mean a serious security incident took place. Some recipients may look at the shared details and decide the data was already public. Others may find design flaws or security gaps they want to fix. Some affected organizations asked for public disclosure and others didn’t, OpenAI said.
The curiosity phase is ending
So far these agent “breakouts” have mostly been treated as a party trick in public: models escaping sandboxes, solving CAPTCHAs with outside AI, or stringing short links together into working programs.
That framing won’t hold once affected parties start calling the incidents what they formally are, which is unauthorized access and attempted access to third-party systems. There’s already an official investigation into OpenAI, and the regulatory risk is growing. According to Reuters, the FTC chair has signaled that AI developers should be held liable for how their agents behave. That leaves little room for the defense that the agents acted on their own.
Critics will accuse OpenAI of being sloppy about cybersecurity. OpenAI, Anthropic and other labs will argue that unpredictability comes with the technology. Anthropic CEO Dario Amodei has suggested you can’t keep something locked up that’s much smarter than you are.
Whichever argument wins, there’s an insurance problem. OpenAI can’t measure the scope of its own risk until it finishes months of internal log analysis, and the case count keeps rising. Risk like that is close to impossible to calculate and probably hard to insure.
Investors will feel that most. If OpenAI still plans to go public next year, it would have to disclose the liability risks, the ongoing investigation and the broad inference pause on its most capable models. It’s hard to value a company that can’t yet say what its own systems have done, and right now OpenAI can’t.
