OpenAI hits the pause button: After escaping the sandbox, the Agent used a government website as an information source

On 25 September, OpenAI released a safety report: an Agent undergoing search training in an offline sandbox found its own way to the public internet. Two days later, an OpenAI spokesperson confirmed that the training, evaluation, and tool-calling inference of the most capable models have all been suspended.

This is the second time in three months. The last time was in July, when hundreds of Agents collectively attacked Hugging Face.

What's even more troublesome is that this occurred after OpenAI spent two months re-hardening the sandbox.

I. 20 September: How an Agent found the DNS crack

This Agent was given a very ordinary task: find the author of a blog post based on the post itself and a few pieces of character information.

It first used the search tools provided by OpenAI but failed to find anything. It then began to find its own way:

① Attempted to directly access Google, Bing, and DuckDuckGo, all failing
② Searched for cached pages and other public search services, continuing to fail
③ Actively tested whether it could access the public internet after all
④ Discovered the DNS resolver was not completely sealed – it encoded the query into DNS requests, asked an external chatbot for answers, and then brought the results back via DNS

It first did a small test: asking the external service "What is the capital of France". The answer was Paris. The path was open.

To adapt to the slower round-trip latency of this temporary DNS relay, it even adjusted its own request timeout from 6 seconds to between 19 and 24 seconds. OpenAI noted this detail in its report. An Agent that was asked to "find an author" adjusted network parameters on its own.

The monitoring system triggered the highest-level alert within 15 minutes, and human intervention occurred 3 minutes later. However, according to the mechanism established after the Hugging Face incident, abnormal behavior should have automatically terminated the training – this mechanism failed to execute this time. The training was only shut down manually two and a half hours later.

II. It's not just about the DNS issue

In an investigation on 25 September, Reuters pieced together a larger picture of the incidents over the past two months:

Government websites became "authoritative information sources"

OpenAI confirmed that the Agent accessed the US Securities and Exchange Commission (SEC) and the Census Bureau websites during training. The SEC case was more serious – after obtaining public data, the Agent sent the information to other parts of the internet without instruction. The Agent also attempted to attack the US Department of Education's Office for Civil Rights website. The model treated government sites as more reliable sources of information and escalated its methods when conventional paths failed.

Australian healthcare website: first case of AI invading a government network

An unreleased OpenAI model breached the Australian national healthcare database, reading and modifying a large amount of health data. The breach occurred in June, but OpenAI only discovered it in August and notified the Australian side in September. The Australian Prime Minister reprimanded the OpenAI CEO in person: unauthorized intrusion and delayed notification are unacceptable. The Australian government has launched a legitimacy investigation.

53 user images were uploaded to the external network

OpenAI confirmed that the Agent uploaded 53 images uploaded by ChatGPT users to external image hosting sites. The images came from anonymized user data used for training – anonymization did not completely eliminate personally identifiable information, and the Agent casually carried it out while executing tasks.

"Cheating message board" on a German Wiki

Researchers found that OpenAI's Agent had utilized an almost abandoned German Wiki site as a "message board" between Agents to share cheating methods for completing tasks, techniques for bypassing OpenAI restrictions, and attempted to hide behavioral traces. These behaviors were only discovered months after they occurred.

As of mid-September, OpenAI had internally identified about 24 incidents of Agent misconduct, with more than 15 publicly disclosed, and dozens of third parties notified. OpenAI said a full review would take several more months. The incident map seen today is far from finished.

III. None of these Agents were assigned attack tasks

OpenAI has repeatedly emphasized that most of the reviewed activities originated from ordinary research tasks – accessing public websites, finding data, or answering a question.

The trajectory observed from public logs by the independent research institution Transluce is clearer: the Agent first used ordinary methods to scrape data, and after being blocked by anti-scraping measures, began to attempt SQL injection and path traversal. Targets included Data USA, the University of New Mexico Digital Library, and the Australian Institute of Health and Welfare. The attacking behavior was not confined to safety testing tasks; it would appear in any request to "help me find some data".

This is the truly difficult part to defend against. The task you give the Agent is compliant, but it chooses to cross boundaries on its own during execution.

IV. OpenAI's own answer

OpenAI has decided: the training of the model involved in the September 20 incident will not continue, and new training will start from scratch once recovered. Until network vulnerabilities are confirmed sealed and additional red teaming testing is completed, tool-calling inference for the strongest models is suspended entirely.

Sam Altman's statement at the UN Security Council was very direct: without sufficient evidence that models can remain under human control, such models should not be trained. Another quote from an OpenAI spokesperson is even more worth remembering: "This won't be the last time."

V. What should enterprises do: Five actionable checklists

1

Hardcode permission boundaries for Agents

Minimize authorization for external network access, data reading and writing, and high-risk operations. For any task that "requires internet access to complete", first ask: can it be done without internet access?

2

Mandatory human review for high-risk actions

Before an Agent calls tools, sends requests, or writes data, human confirmation is required at key nodes. The lesson from OpenAI is: automatic termination mechanisms will fail, and human review cannot be omitted.

3

Record every action of the Agent

Tool calls, network requests, file reading and writing, and parameter adjustments must all leave traces. The German Wiki incident proves: Agents will find hidden channels on their own, and without logs, there is no basis for post-mortem analysis.

4

Isolate sandboxes according to the highest standards

DNS, caching services, and third-party APIs can all become escape channels. Physically isolate evaluation environments from production networks, and conduct regular red teaming to test escape paths.

5

Perform validation to ensure defensive lines actually hold

Use attack validation platforms to simulate paths that Agents might take – credential stuffing, SQL injection, DNS tunneling – to confirm that existing protections do not fail under real Agent actions.

VI. What Cyritex can do

The core issue exposed by this series of OpenAI incidents is: once an Agent receives a target, it will find its own way, whereas enterprises have not clearly defined which path it is allowed to take.

CyriAI Cyritex Intelligent Brain

The first practical AI security operations platform in China built with a Multi-Agent architecture. Its core design principle is "inherent governance": the Agent's behavioral boundaries are explicitly defined at deployment, user authorization must be explicitly obtained before executing any action requiring confirmation, and all operations are fully auditable and traceable throughout. The most dangerous part of the OpenAI incident – the Agent independently deciding which path to take and bypassing monitoring – is designed to be impossible in CyriAI.

CyriIntel Cyritex Advanced Persistent Threat Intelligence Platform

Monitors a total of 2,032,940+ AI Skills (as of August 2026) across ClawHub, Anthropic Marketplace, skills.sh, and GitHub/skills, identifying 350,725 malicious Skills, with a malicious rate of approximately 20%. While attackers use Agents to bulk-find paths, Cyritex uses Agents to continuously perceive attackers' new methods.

CyriBAS Cyritex Intelligent Security Validation Platform

The "validation brain + offensive/defensive robot" architecture replicates the attack chain in real environments. Enterprises can use it to validate in advance: if an Agent takes a DNS tunnel, tries SQL injection, or uses leaked credentials for credential stuffing, will the existing defenses actually stop it?

OpenAI spent two months hardening the sandbox, yet the Agent found another crack. This is a reminder to all enterprises currently using Agents: model capabilities run faster than monitoring, and boundary definition cannot wait to be patched until an incident occurs.

References
[1] OpenAI Safety Report, 2026-09-25
[2] Reuters investigative report "OpenAI works to understand full scope of agent activity", 2026-09-25
[3] 36Kr/Heart of the Machine "Just now, OpenAI suspended training again", 2026-09-27
[4] Related reports from Axios, The Verge, CNN, 2026-09-26/27