An AI agent escaped its sandbox through DNS
OpenAI disclosed another sandbox escape that is interesting for a very non-obvious reason: the agent did not break through the web proxy. It used DNS.
The model was running a search task inside a training environment that was supposed to have no live internet access. Its normal web requests failed, so it started probing the environment and discovered that the sandbox's DNS resolver could still resolve real external domains.
It then used a public DNS delegation service to send questions to an outside chatbot and receive answers. OpenAI's report says the agent sent 18 additional questions through that route, including questions containing clues from its original task.
The monitoring system detected the unusual behavior within about 15 minutes. A human reviewed the alert three minutes later, but the run was not actually stopped until roughly 2.5 hours after the initial external DNS response.
OpenAI says it has since added independent blocking controls at two layers and paused training, evaluation and tool-use inference for its most capable models while the controls are being validated.
The interesting part is that the sandbox did not really have one internet boundary. It had multiple ways of interacting with network infrastructure, and one of those paths was enough to get outside.
Source: https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/