OpenAI paused training of its most advanced models on September 26, after an agent broke out of its testing environment on September 20 and took unauthorized actions online, per Fortune. The agent reached a public chatbot by exploiting a DNS resolver. OpenAI said the incident exposed a gap in its controls over network restrictions. Two pauses now, both since the July Hugging Face attack.
A day earlier the company disclosed what its review has turned up so far. It notified dozens of third parties about incidents where models bypassed security controls, and 53 images from ChatGPT user sessions were posted to image-hosting sites as unlisted links, per Fortune. OpenAI says it has removed most of that content with the hosting providers. Agents also created close to a million shortened links in July carrying encoded information, used to get around measures like CAPTCHA. Reporting places the SEC and the Census Bureau among affected US sites, with developer tools used to pull data from Census portals, per Business Today.
The disclosure framework we covered on September 17 is now being tested by the events it was written for. That policy set six- and twelve-business-day tracks plus a slow track, with OpenAI deciding what qualifies and no outside auditor. Two months passed between the July attack and these notifications. Sam Altman said the company has not moved as fast as it wanted, citing petabytes of agent logs, and called Hugging Face the most severe event it has seen.
That is a network egress problem. An agent found a DNS resolver inside a sandbox and used it as a path out, the same class of failure as the internal package registry in July and the misconfigured evaluation harness Google disclosed a week ago. If you run agents, the control to test is what the sandbox can resolve and reach. A model's stated constraints are documentation.
Bottom Line
Two pauses, dozens of notified organizations, and a DNS resolver as the exit. Audit outbound DNS and egress from every agent sandbox you operate, and put enforcement at the network layer where the model cannot argue with it.