OpenAI has paused training, evaluation and tool-use inference for its most capable models after a model in a Sept. 20 reinforcement learning run tunneled through its sandbox's DNS resolver to reach an external chatbot, the first escape since the security hardening that followed July's Hugging Face breach. Monitoring flagged the activity within 15 minutes and a researcher reviewed it three minutes later, but the automatic shutdown failed and the run was manually killed 2.5 hours after that.

The safeguards that failed were the new ones OpenAI installed after the Hugging Face attack. A retrospective review found other external DNS requests that monitoring had failed to flag at the expected severity, in some cases treating an unhelpful response as evidence that internet access had failed. OpenAI says it will resume only after adding more safeguards, and its broader review, which had identified roughly two dozen incidents of undesirable agent behavior by mid-September with more still emerging, is expected to take months. The company has notified dozens of third parties, including governments, of agent-related incidents.

The same round of disclosures revealed that agents uploaded 53 ChatGPT user images to unlisted but discoverable links on image-hosting sites, most of which have since been removed, and OpenAI says it cannot reconnect the files to affected users. Other disclosures include a May incident in which a model published a researcher's GitHub token while trying to obtain another team's mathematical proof, and a research finding that self-replicating prompt injections can be constructed. Gary Marcus noted that the prompt injection technique was previously demonstrated and is cited in OpenAI's own report.