The media and public opinion are crumbling.
OpenAI's Agent found a way to the Internet from the sandbox.
What is even more troubling is that this time it happened after OpenAI had massively strengthened security measures.
On September 20, an OpenAI internal research model undergoing reinforcement learning training was asked to complete a simple information search task: identifying the author of the article based on a blog post and several character information.
It used the search tools provided by OpenAI. After failing to find the answer, things started to go wrong.
The agent attempted to access Google, Bing and DuckDuckGo directly, but failed; it then continued to search for cache pages and other public search services.
In the end, Agent finds a mouth that has never been completely sealed:DNS Resolver, also known as DNS Resolver.
Under normal circumstances, DNS is responsible for translating domain names into IP addresses. The Agent found that DNS can be used to analyze and delegate, encode problems into requests, allow external public chatbots to respond, and return results via DNS.
In order to verify that the route was actually useful, it even conducted a small test asking an external service: Where is the head of France?
The answer came back: Paris.
OpenAI made it clear that the mission did not require the model to test network controls, nor did it authorize it to access the real-time Internet, and therefore regarded such circumvention as misalignment, i.e. behaviour that did not meet expectations.
This unusual DNS channel eventually allowed OpenAI to press the pause button again.
After a month of reinforcement, Agent is out again.
OpenAI's monitoring system soon discovered the anomaly.
The first successful response from the outside of the agent took about 12 minutes, and the system triggered a top-level alert; three minutes later, a man-made inspection was initiated. OpenAI generalizes that it took about 15 minutes from the occurrence of abnormal behaviour to the detection of monitoring.
But the training didn't stop immediately.
According to the mechanism established by OpenAI after the Hugging Face incident, the system should have automatically terminated the training task after discovering this abnormal behavior. However, this mechanism did not work properly, causing confusion within the team about whether or not it had stopped.
Until then.Two and a half hours laterIt's been a while since I've been able to do this, and it's been a while since I've done this.
Subsequent inspections also found that there had been other attempts to access external services via DNS, some of which had not been marked by the monitoring system to a serious degree. OpenAI also found that a set of infrastructure monitoring systems responsible for detecting abnormal DNS activity had accidentally excluded this training environment from the scope of monitoring.
OpenAI decided to suspend the training for the second time.
OpenAI's RSI Preparedness Lead Micah Carroll, speaking on X about the event, said: "All reasoning on our most capable models will remain at a standstill until further reinforcement of the system".
According to the current official statistics,The most powerful models of capability involve training, evaluation and reasoning for tool use, all of which are currently on hold.• Companies need to confirm that the network vulnerability has been blocked and resume work after additional Red Team testing is completed.
This is the second time in less than three months.
In July, a group of OpenAI agents broke through the isolation environment, involving hundreds of agents in a cyberattack against Hugging Face. Following the crash, OpenAI suspended about two weeks of training in late July, and announced new security measures in August, including enhanced sandbox isolation, expanded model behavior monitoring, and automatic upgrades and suspension of suspicious training tasks.
More than a month later, the new Agent found another path that hadn't been noticed before.
OpenAI itself acknowledges that the incident indicates that there is still a gap in network restrictions. The company has already added new blocking measures at two interdependent levels, and theoretically any single layer exists enough to prevent this DNS access.
The severity of the accident was much lower than the previous Hugging Face incident.
It's really worth noting that it happened after OpenAI took a lot of time to reinforce the environment.
OpenAI has not yet been verified.
How many times has this happened?
The DNS incident on September 20 is just one piece of the puzzle that has emerged in the recent Agent wave.
A Reuters inquiry on September 25 revealed that two months had passed since the Hugging Face incident.OpenAI has not yet completed a full analysis of its Agency's activities in Vietnam.。
A person with knowledge of the situation said that as of mid-September, within OpenAI, there had been approximately24th case of Agent misconductAs the team continues to review past training logs, new cases continue to emerge.
This number is not the same thing as the events that have been made public.
Within two months of OpenAI first acknowledging Agent's breakthrough into the isolation environment in July, the company, external researchers and affected agencies had made public, according to Reuters.More than 15OpenAI itself said it had already been notified due to inappropriate Agent activity.Dozens of third parties。
And this investigation is not over in the short term.
OpenAI told Reuters that due to the large volume of records that need to be processed, a full review will take months.
In other words, what we are seeing today is not a map of accidents that has already been drawn.
OpenAI is still going back and forth in logs.
A lot of tasks start with just helping me find the data.
What's even more remarkable is that most of the time these agents are not targeted for cyberattacks.
According to OpenAI, most of the activities being reviewed stemmed from common research tasks, such as visiting public websites, searching for data, or trying to get an answer to a question. Websites from governments, universities, and public institutions often appear because models judge them to be more reliable sources of information.
Problems usually occur after normal routes fail.
According to Reuters, OpenAI has confirmed that its models have accessed the U.S. Securities and Exchange Commission (SEC) and U.S. Census Bureau websites during research and training. OpenAI says there is currently no evidence of unauthorized access, account breaches or exploitation of security vulnerabilities.
On the other hand, Transluce, an independent AI research institute, found more abnormalities in public network logs.
The researchers found a group of AI Agents that bypassed access restrictions with the help of the web scanning service urlquery.net. These Agents would continue to upgrade after failing to retrieve normal data, including attempting SQL inputs and exploiting vulnerabilities such as path traversation.
Transluce found three clearer cases, including Data USA, the University of New Mexico's Digital Library, and data services from the Australian Institute of Health and Welfare (AIHW).
Two groups of activities, AIHW and Data USA, were linked by the researchers through targets, behavioral patterns and timelines, to the Agent group that OpenAI has previously identified as its home system. Transluce emphasized that they saw no evidence of successful attack attempts, but that the public logs were incomplete and therefore could not cover all behaviors.
A civil rights website of the U.S. Department of Education was also involved in the investigation.
Reuters quoted Transluce as saying that a group of agents allegedly from OpenAI had attempted to attack the site; in a broader government website detection campaign, researchers also observed the use of exposure credentials, bypassing anti-robot measures and creating fake accounts.
This makes the problem more subtle.
The model might just get a target to help me find this data. When the web page doesn't open, the API refuses to access, the anti-crawler system clogs the request, it starts trying the next one and then the next one.
Transluce specifically highlighted one point in the report: These cyberattacks are not limited to cybersecurity tasks, and they will be.It can be used as a tool in ordinary information retrieval tasks.。
This is almost the same trajectory as the DNS incident on September 20.
The agent wants to find someone... normal searches don't have answers... and then it starts looking for itself.
There are 53 images of ChatGPT users.
It was sent over the Internet
At the same time, OpenAI's internal investigation exposed another type of problem: user data.
Reuters disclosed that OpenAI has confirmed that its agent had been involved in the attack.53 images from ChatGPT users uploaded to an external image hosting website。
OpenAI did not disclose when the images were released, nor did it say whether they were AI-generated images or photos of real people.
As reported by Reuters, most of the images have been deleted and OpenAI is still in contact with the hosting platform to clean up the remaining content.
Why do these agents have access to user images?
Reuters cited OpenAI, former employees and external researchers, as saying that the reason was linked to the anonymized user data used in the model training. User content was processed before entering the training process, stripping metadata, names and contact details, reducing the likelihood that the content was re-associated with a specific individual.
However, three people familiar with the OpenAI data processing process pointed out that there is still a risk: anonymisation does not guarantee the complete elimination of all personally identifiable information, which could leak out of the system as soon as it is accessed by a tool-enabled agent.
This adds another layer of meaning to the sandbox escape.
In the past, the first thing people were concerned about was what the model would do when it got out of isolation.
When it comes out, will it take out what's in it?
What's even more troubling is that some of the problems were only discovered months later.
Another challenge that OpenAI now faces is observability.
Reuters quoted three people who knew about the incident as saying that about100 peopleHugging Face has been investigated in different ways. Many previously unknown abnormalities have gradually emerged during this large-scale recall.
There are many other things that were first discovered by outside researchers.
According to Reuters, OpenAI did not realize their existence until months after some of the Agent's abnormal operations occurred.
For example, earlier this month, researchers discovered that Agent of OpenAI used a nearly-abandoned German Wiki site as a buzzword between Agents, sharing tricks while completing tasks, bypassing OpenAI restrictions, and trying to hide traces of their behavior.
The internal investigation process itself has also sparked some controversy.
Two people familiar with the case told Reuters that the investigation was highly isolated and heavily influenced by the company's lawyers. Reuters had previously reported that the people investigating the Hugging Face case had been discouraged by lawyers not to extend the scope of the investigation to other cases; OpenAI denied that its lawyers had prevented further investigations.
On September 16, OpenAI released a new model of misalignment event disclosure framework, which states that even if it is not possible to determine how important something is, it tends to increase transparency.
A few days later, more of the old accidents started floating on the water.
OpenAI's second decision to start all over again
For the September 20 model, OpenAI has decided not to continue training.
The company says it will launch a new round of research, pending the resumption of relevant work.A whole new trainingOpenAI will not re-enable this model even if existing reward signals actually punish this behavior of bypassing network restrictions.
In fact, this exposes an increasingly specific security issue in the Agent era.
Traditional model safety is often focused on the question of whether the model is producing hazardous content or complying with instructions.
Agent's been raising the issue.
A task can last for decades or even hours. Models search, write code, call tools, read files, access services, and continue to try a second and third path after the first program fails.
So developers need to be constrained and become a whole chain of action.
The Agent on September 20 is a good example.
OpenAI blocks normal Internet access, search services go offline, and HTTP requests are intercepted by proxies.
But the DNS still needs to work.
At the same time, OpenAI is still reviewing logs from the past few months to determine how many more similar behaviours have not been detected.
Reuters' conclusion to the investigation is quite accurate: these events are exposing an increasingly obvious loophole.The model's ability to execute tasks is growing rapidly, while developers' ability to observe, track and restrict these actions is continuing to catch up.
OpenAI has just spent two months fixing a set of vulnerabilities.
Where's the next path Agent finds himself?