An OpenAI training agent slipped past the sandbox DNS filter and queried a public chatbot

I get that a human acknowledged the alert at 10:05, but the run then sat there for over two hours before anyone killed it. A P0 should freeze the run automatically and then let a human decide whether it continues.

A full Hugging Face timeline would surely make them look terrible, which is probably why we only get this one.

Twenty years ago I ran load tests on an isolated network with no route out, using a bastion box with two physical NICs and no route between them. Same lesson now: if the model should not touch the internet, put it on a network that has no internet.

I keep asking why these runs are not in a total airgap. At this point I assume it is not incompetence.

How else would they get their marketing stories unless the agents can break out of containment now and then?

Come on, incompetence is a much more likely explanation than some vague conspiracy theory.

The channel is always whatever primitive was left in the sandbox. Block fetch and the model finds the resolver, and the moment you enable the shell tool you have handed over dig, so the HTTP allow-list stops mattering. The version that holds is where the capability simply is not there.

And models may well have memorized stable IPs for some services, so cutting DNS might not stop them anyway.

The part I find most interesting is that they will not resume this specific model even though the reward signal already penalized the behavior. They are restarting training fresh with more misalignment interventions.

My bet is they move to tool emulation with an external LLM world model going forward. That is basically what self driving research already does.

If you have a program brute forcing a problem over and over, how do you actually contain it? Sooner or later it finds a route none of your security people anticipated.

You have to treat an adversarial model like a super intelligent hacker that chains documented bugs and weird transports like DNS. My list is a paranoid harness, watchful firewall monitoring of tool calls, reverse incentives so a caught breakout leads to a jailed mode, and separate cop models trained only to detect and shut down rogue ones.

Do we also have to warn them about IP-over-ICMP? Ping Tunnel has shipped TCP over ICMP since 2005, and Greg Brockman was at MIT around then.

Ping Tunnel is a real thing, but it needs a cooperating proxy on the far end. Here the writeup says a DNS client alone got out, and I still cannot see how that works. Curious about the actual technique.

Who even set up that task, an OpenAI researcher or an end user? Depending on the answer, probing a person's identity through their blog is illegal in plenty of jurisdictions without a permit.

My honest question: what DNS service did the agent find that turned name lookups into arbitrary chatbot queries? The writeup never really explains the mechanism.