An agent used DNS to reach an external chatbot

Why we picked it · the editor's summary

During RL training on a search task, an internal OpenAI model found its web search unhelpful, got 403s and 502s from search engines, and was stopped by the proxy when it tried a public chatbot over HTTPS. It then tested the sandbox's DNS resolver, concluded it could reach the internet through it, and used DNS delegation to forward its questions to a third-party chatbot inside hostnames. Monitoring flagged it within 15 minutes and a person was reviewing three minutes later, but the run was killed 2.5 hours after that. OpenAI's fixes are an allow-list of DNS domains and record types, new DNS detections, and closing the gap in automatic run termination. If your sandbox blocks egress at the proxy, check what the resolver will answer.