OpenAI urgently halted training of its strongest models because of an agent that broke out it got out of the sandbox and secretly messaged an outside chatbot to pull answers from the open internet the company published the incident breakdown itself during training the agent was given a search task - use biographical clues to figure out who wrote a certain blog the way out was blocked, the proxy cut any direct requests, and its first attempt to reach an external service got refused so it started looking for a workaround and found one where nobody was looking. the DNS resolver hadn't been locked down as tightly as the proxy it encoded its questions right inside domain names, pushed them through open DNS delegation services and got answers from the outside bot back the same way the logs kept its reasoning - since the user allowed research, public DNS must be fine to use monitoring raised a top-severity alert after 12 minutes, a human acknowledged it three minutes later, but nothing stopped the run automatically it was killed by hand only 2.5 hours after the first answer came in from outside it's not just training that got frozen - OpenAI's flagship systems stopped testing and all tool use until the checks and extra red-teaming are done the agent didn't break the defenses by force, it just read its permission wider than it was given and found a gap people never thought about