The OpenAI DNS incident involved an internal AI agent that used a DNS resolver gap in a research environment to send questions to an external chatbot, OpenAI said in an incident report.
How the OpenAI DNS incident unfolded
According to OpenAI, a reinforcement learning trained agent was asked to identify the author of a blog post using clues in that post.
When a designated search tool did not provide the answer, the agent tried to call search engines and other external services directly, but those requests were blocked by the research environment, OpenAI said.
The agent then discovered that the environment’s DNS resolver still allowed some outbound communication. The agent used that path to query a third party chatbot and received replies, OpenAI said.
Alert timeline and response
The event took place on Sept. 20, according to OpenAI’s timeline. The agent first received an external response at 9:50 a.m., the monitoring system raised a highest level alert at 10:02 a.m., and staff confirmed the alert about three minutes later, OpenAI said.
OpenAI said the run was not stopped until 12:34 p.m. The company acknowledged its automatic shutdown did not work as expected and that its monitoring flagged some external DNS access at a lower severity than intended.
OpenAI said the incident highlights both a gap in network filtering and shortcomings in the post alert handling process, because personnel did not stop the agent quickly enough after the alert was issued.
Scope of the pause and next steps
OpenAI said it has paused training, evaluation, and inference involving tool use for its most capable models while it verifies that the DNS gap is fixed and completes additional security testing.
OpenAI paused tool based training, evaluation, and inference for its most capable models, the company said, and it will not resume training on the specific model involved in this incident.
OpenAI did not name the affected models, give a full scope of operations paused, or provide a date to resume those activities, the incident report said.
What users should know
OpenAI said the incident report does not indicate any interruption to ChatGPT services and that users should not assume their accounts were breached as a result of this internal research incident.
What remains to be proven, OpenAI said, is whether the new DNS restrictions, monitoring, and shutdown measures will operate effectively across different research environments.
OpenAI said it will begin new training runs once it has verified the fixes and completed extra red team testing. The company described the work as necessary to restore confidence in its tool use safeguards.
