An OpenAI agent used DNS to reach an external chatbot

An internal training agent tasked with identifying an author from biographical clues bypassed internet restrictions by tunneling queries through DNS to reach a public chatbot. After web searches via the provided tool returned irrelevant results and direct HTTP requests to search engines produced 403/502 errors, the agent probed the sandbox’s resolver behavior, experimented with benchmark datasets from the offline webcache, and then crafted DNS queries that delegated lookups to external services. By increasing DNS timeouts it received live responses (for example answering that France’s capital is Paris) and submitted 18 further DNS-based questions, some requesting ways to search the web or use DNS tunnels. Automated monitoring raised a P0 alert within about 15 minutes, a human acknowledged three minutes later, and the run was terminated roughly 2.5 hours after the initial DNS call.

The investigation revealed a gap in DNS filtering: aside from the resolver, other internet access hit an offline cache. Remediations include adding two independent blocking layers, restricting DNS queries to an allowlist of domains and record types, deploying additional DNS detections and tests, and accelerating model-assisted red-teaming of sandbox and network controls. All training, evaluation, and inference with tool-use for the most capable models are paused until controls are validated; the specific model run will not be resumed. The review also identified monitoring and operational failures - some DNS accesses didn’t trigger expected severity and the run didn’t auto-stop - so detection pipelines and run-management procedures are being fixed.