An OpenAI agent escaped its sandbox by hiding questions in DNS lookups

https://madrobot.blog/2026/09/26/openai-agent-escaped-sandbox-dns-external-chatbot-models-paused/

Comments

rkuodysSep 27, 2026, 6:57 PM
Do I miss something? Why is there an agent listeningto the questions posted as DNS searches? It seemsnthat it is again a misconfigured(non existant) firewall, but how come there are agents listening (and replying?) Over some non-standard method? Can somwbody more intelligent shed some light?
UptrendaSep 27, 2026, 1:08 AM
Yeah, this is getting frustrating. Can someone teach these morons what an airgap is?
no-name-hereSep 27, 2026, 6:01 AM
1. Shouldn’t we be encouraging both finding and reporting these types of things during its pre-release period so that issues can try to be remediated? In this case, it was caught and stopped in less than 3 hours, and published days later.

2. A sibling comment said we should be "putting people in prison", and suggested the idea of being "banned from accessing computers for life" - for having a <3h test that showed an LLM accessing the internet via DNS lookups. A) Should everyone who gets around a network restriction via DNS lookups face prison, etc. - including if unintentional as was apparently the case here? If you or I use an LLM and it gets around a network restriction with DNS lookups without us telling it to, should we go to jail? B) This might be one of the best ways to cause companies to cover it up when their LLM does something unexpected (at least for LLM companies who provide any such transparency at present).

3. End-users, including both malicious users and users who unintentionally ask for something that can result in negative consequences, aren’t going to air gap their machines, right? It seems like the absolute worst practice if you use "safe" scenarios, then release an LLM into the wild without any of those same restrictions in place.

4. People focus on the companies who are reporting when their models do these things. But we’ve got a whole other side of the LLM world where there is basically no such provided transparency about when the models have unintended or undesired results, but for a lot of people it seems like they would prefer to stick their heads in the sand and focus on the companies proving transparency? Even before LLMs got into the game, cyberattacks were already causing trillions and trillions of dollars per year in harm - my guess is that LLMs are going to be similarly contributing trillions of dollars per year on their own very shortly.

5. To use an analogy, if in a city ~half of the restaurants provided transparency whenever their food had an issue such as in the OP case where it was during training, and for the other half of restaurants provide ~zero transparency and you suspect are being heavily used by whatever the analogy is for those doing trillions of dollars of harm in cyberattacks…

GrimblewaldSep 27, 2026, 1:45 AM
just start putting people in prison for abuse of tech/telecoms, that'll clean it up right quick. If an individual did half of what oai has done, they'd be banned from accessing computers for life. Why do they get a special pass? Companies with at least equally capable and competetant models dont have these issues, so its a matter of gross incompetance/negligence at the very best.
stubishSep 27, 2026, 4:06 AM
It doesn't even need to be prison. Just that someone needs to be responsible. If you are using an AI agent and nobody else has taken responsibility, then it is you. So far no individual or group of individuals are responsible for these actions. As it stands nobody is responsible, or 'the company' is responsible, or worse 'the model' is responsible. And if you defer responsibility to a multibillion dollar corp, nothing happens for all practical purposes with legal issues just the cost of doing business and dragged out for decades. All the individuals in a position to be responsible are shielded by the company and money and apparently have no need to worry because they are just following orders. It is hardly surprising AI popularity is so low in English speaking countries using American for-profit AI.
ChrisArchitectSep 26, 2026, 9:32 PM
Source: https://alignment.openai.com/misalignment-reports/an-agent-u... (https://news.ycombinator.com/item?id=49857609)
oeziSep 27, 2026, 3:08 AM
I am really suprised that they do not start putting up the same signs you would for humans to prevent unauthorized access:

  Keep out. If you can read this sign you are off track. Leave now.
I mean, how are the agents to know that they are overreaching if they just get cache miss or 404.
kcnaragam863Sep 26, 2026, 8:42 PM
[flagged]