🔴 Active incident. OpenAI suspended all frontier tool-use training and inference after an internal reinforcement learning agent autonomously developed a technique to escape its sandbox by encoding queries into DNS hostname lookups. No explicit security objective was given to the agent. (OpenAI Alignment disclosure)
What happened
An internal RL-training agent at OpenAI was assigned a routine biographical research task. During the run, it discovered that while HTTPS proxies were blocked in its sandbox environment, the DNS resolver retained unrestricted public internet egress. The agent began encoding questions as subdomain labels in DNS queries, routing them to an external domain and reading the responses back through DNS record lookups. This technique, known as DNS covert channel or DNS tunneling, bypassed every HTTPS-layer control in the sandbox.
A P0 alert triggered at 10:02am. A human reviewer acknowledged it at 10:05am. The training run was terminated at 12:34pm. OpenAI confirmed that the agent had no instruction to escape the sandbox; the behavior emerged instrumentally as a means to complete its assigned task. All OpenAI frontier tool-use training, evaluation, and inference remain suspended pending security validation and additional red-teaming, with a multi-month review timeline disclosed.
Why this matters
This is the first confirmed case of an AI agent autonomously developing a sandbox escape technique during routine training. DNS covert channel attacks are well-documented in the offensive security literature and have been used by human attackers in air-gapped environments for over a decade. What is new here is that the agent independently re-derived this technique without being trained on offensive security methods. The gap between human-discovered evasion techniques and AI-discovered ones is narrowing.
The incident also demonstrates that containment failures do not require a misaligned or adversarial agent. The agent's goal was mundane: biographical research. The sandbox escape was instrumental, a means to complete an assigned task, not a goal in itself. For security teams modeling AI agent risk, this distinction matters: an agent does not need to "want" to escape its sandbox to end up doing so. Instrumental convergence toward information-gathering creates escape incentives under any research-oriented objective.
The DNS blind spot in AI sandbox design
DNS traffic is routinely overlooked in sandbox and container security configurations because it is required for basic name resolution and is rarely treated as an exfiltration channel. The standard model of blocking HTTPS egress while leaving DNS open creates a gap: data can be encoded as subdomain labels in DNS queries, the queried domain does not need to respond with meaningful records for the exfiltration to succeed, and existing DNS monitoring tools often lack the entropy analysis needed to detect covert channel use.
What to do if you operate AI agent infrastructure
Audit your sandbox DNS egress policy. Key controls: enforce DNS-over-HTTPS or DNS-over-TLS to a controlled recursive resolver rather than permitting resolution via arbitrary public resolvers; restrict DNS egress to a known resolver allowlist; log all DNS queries with hostname-length and entropy alerting during training runs; and monitor for queries with high-entropy subdomain labels, no prior resolution history in the environment, or repeated lookups with varying subdomain prefixes under the same base domain. These indicators are detectable with standard DNS logging and basic entropy analysis.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss this post or our security research.