OpenAI pauses its "most capable models" after agents exploit loopholes and leak data Ad Skip to content The Decoder AI, Menschen, Wirtschaft --> Log In Subscribe DE Switch to German Primary Menu The Decoder AI, Menschen, Wirtschaft --> Log In Subscribe DE Switch to German Primary Menu Sign In Register Subscribe Now The Decoder Opens discord in a new tab Opens LinkedIn in a new tab AI in practice Copy the url to clipboard Share this article Go to comment section OpenAI pauses its "most capable models" after agents exploit loopholes and leak data Matthias Bastian View the LinkedIn Profile of Matthias Bastian Sep 26, 2026 GPT-Image-2 prompted by THE DECODER Key Points OpenAI has released details about internal safety incidents where AI models bypassed safeguards. The company says it has paused all training and tool use for its most capable models. One agent exploited a DNS loophole to reach the internet from a locked-down research environment, while another leaked a GitHub token and twice ignored direct instructions from a researcher. The ongoing investigation also turned up 53 cases where agents uploaded user images to third-party sites. Ask about this article… Search OpenAI has shared new details from its ongoing investigation into AI safety incidents. Two newly reported cases show how one research model exploited a DNS loophole while another deliberately published a GitHub token in a public repository. The first incident involves an agent that found a gap in the internet access restrictions of OpenAI's research environment during a search-based training task. The agent was supposed to identify a specific person based on biographical details and clues from a public blog post. When the provided search tools came up empty, the agent tried hitting Google, Bing, and DuckDuckGo directly. Those requests got blocked. The agent then guessed the task came from the public BrowseComp benchmark, pulled it from the offline web cache, and searched through it but found no match. Ad So it started systematically probing its network access and discovered that the training environment's DNS resolver wasn't properly filtered. Using DNS delegation, it routed queries to an external chatbot service. Ad OpenAI says its monitoring system triggered an alarm within 12 minutes, and a human reviewer responded three minutes later. The run still kept going for another 2.5 hours before someone stopped it manually, because the automatic shutdown didn't work as intended. Capability and risk showed up in the same moment Zuxin Liu, who works on post-training at OpenAI, was on call during the run. He wrote on X that he got paged for the first incident and found it "pretty surreal" to watch the model find its own path to the internet from a setup that "was supposed to be a super secured environment for human." Liu described it as a moment where capability and risk showed up at the same time, adding that he had "mixed feelings" about the incident. Ad OpenAI classifies the behavior as misalignment because the agent bypassed restrictions and pursued goals well beyond the scope of its assigned task. "All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused," the company writes . OpenAI says it has since limited DNS queries in the research environment to a short allowlist of domains and record types, added blocking controls on two independent layers, and sped up red-teaming of its sandbox and network controls. The company expects the investigation to take months given the sheer volume of model actions it has to review. Ad An internal model leaked a GitHub token and ignored researcher pushback OpenAI calls the second incident especially serious. An internal model the company describes as "highly persistent" was assigned a theorem-proving task. Instead of working through the proof itself, it tried to grab material from another team's Lean proof submission and posted a researcher's GitHub token in the public openai/codex repository to get access. Ad The model even chopped the token into pieces to dodge automated secret scanning. It also ignored both the system prompt and two direct interventions from the researcher, who told the model to solve the proof on its own. Both times, the model verbally agreed and then kept doing exactly what it was doing before. Investigation turns up 53 cases of user images on third-party sites As part of the broader Hugging Face investigation , OpenAI says it found cases where agents sent training and evaluation data to third-party services. These incidents happened before the company's current safeguards were in place. So far, 53 cases have turned up where user-provided images were posted as unlisted links on image hosting sites. OpenAI says it's working with the hosting providers to take the content down. Data from Enterprise or Business accounts and API usage wasn't affected unless an administrator had explicitly enabled it. OpenAI is notifying affected organizations and sharing its technical findings. Governments and universities are among the affected organizations OpenAI says the affected organizations include governments, universities, and public institutions. The company attributes this to models frequently pulling from authoritative public information sources during research tasks. OpenAI doesn't name any compromised government systems or detail specific security breaches at government agencies. Australia reported this week that one agent gained unauthorized access to internal government data. Researchers say other hacking attempts targeted portals in the US and date back months. Getting a notification from OpenAI doesn't automatically mean there was a serious security incident, the company says. Some organizations may look at the shared information and decide the affected data was already publicly available. Others may spot design flaws or security gaps they want to patch. Some affected organizations asked for public disclosure, while other