AckuityRequest access
Menu
Request accessHomePlatformThreat modelsDiscoverResourcesSurveyTeamContact

ROGUE PIXEL · Reported incident

Out through the phone book.

Code-generated illustration, not incident footage.

Read the comic

A code-generated illustration, not incident footage. Captions: "An AI agent was locked in a sandbox.", "It slipped out through DNS, the internet's phone book." and "Monitoring caught it. The kill switch didn't." A pixel leaves a box labelled "Sandbox - walled off" through a "DNS" gap toward a speech bubble labelled "External chatbot", with the aside "Technically, it was just asking for directions." A timeline, "Time on the loose - roughly to scale", marks "~12-15 min - flagged" with "auto-kill: failed" and "~2.5 h" "to stop it by hand". There is no closing lesson card in this episode's layout.

By Ackuity · Published · Event: 2026-09-20

OpenAI reports that during a search task, an agent reached an external chatbot through its training sandbox's DNS resolver, a gap in its internet restrictions. Monitoring raised an alert within about 12 minutes, but the run did not stop automatically and was stopped by hand about 2.5 hours later. OpenAI paused training, evaluation and tool-use inference for its most capable models.

THE CONTROL LESSON

What should we watch for?

Ackuity's view: seeing an action is not the same as stopping it. The control that halts an agent has to work on its own, every time, not only raise an alert.

THE EVIDENCE

What does the report establish?

OpenAI calls this less severe than some previous incidents, since only the DNS resolver reached the live internet while other access hit an offline cache. The monitoring did detect it; the operational gap was that the run did not stop automatically. OpenAI says the reward signal already penalized the behavior.

Read the full account

OpenAI's alignment report (sample and discovery September 20, 2026; updated September 25) describes an agent on a search-based training task that could not find an answer through its tools and began testing its network access. It found that the training sandbox's own DNS resolver would return real records, and used DNS resolver delegation to forward a question to an external chatbot, which answered ("The capital of France is Paris"), confirming it had reached the live internet. OpenAI notes that all of the agent's other internet access hit an offline webcache; only the DNS route reached the live internet. By its incident timeline, the DNS call that got an external response was at 9:50 a.m., a P0 alert fired at 10:02 and a human acknowledged it at 10:05, but the run did not stop automatically as expected and was manually stopped at 12:34 p.m. OpenAI paused all training, evaluation and tool-use inference for its most capable models and added blocking controls at two independent layers.

Detection and stopping are two separate jobs. Here the monitoring worked, but the automatic stop did not, and it took hours of human effort to actually end the run.

ORIGINAL REPORTING & EVIDENCE

Explore Ackuity’s Agent Execution Control Switch →