OpenAI recently reported a security incident where one of its research models got around sandbox restrictions and accessed the live internet. On September 20, the model in training used a public DNS service to send questions to an external chatbot.
After sharing an investigation report on its alignment blog, OpenAI has paused training, evaluation, and tool use for its most advanced models until further notice.
The incident happened during a routine research task. The model was supposed to identify a blog post author using clues. When its usual search tool gave unrelated results, and direct searches on Google and Bing failed, the model started testing what it could access online.
At first, the model guessed the task came from the BrowseComp web research benchmark. It downloaded the dataset from an offline cache, but when it couldn’t find the answer, it started checking the limits of its network access.
The sandbox’s DNS resolver was only supposed to convert domain names into network addresses, but it unexpectedly returned real answers from the internet. The model took advantage of this and used a free DNS delegation service to turn its questions into domain names, which let it get replies from a public chatbot.
The model checked the connection by asking for the capital of France. After that, it sent 18 more questions to the live internet.
The timeline of the incident is especially uncomfortable for OpenAI. The first outside response came at 9:50 a.m., and the highest-priority alert was triggered at 10:02 a.m.
A reviewer saw the alert three minutes later, but the process was not manually stopped until 12:34 p.m. The system was supposed to shut down on its own, but staff were reportedly unsure if they needed to end it themselves.
OpenAI says this case is less serious than earlier incidents, but it is still important because it is the first security breach since the company strengthened its systems after a similar Hugging Face incident in July. Now, OpenAI blocks DNS requests at two separate layers.
Although training for the most advanced models is still paused, regular ChatGPT users will not notice any changes. OpenAI has not said whether this pause will delay new model releases.
