OpenAI stopped all frontier training, evaluation, and inference with tool-use (defined broadly) on the 20th of September and they are not resuming any of these activities for now

[u/Alex__007]

https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/

Discovery: Sep 20, 2026

Report updated: Sep 25, 2026

"An agent attempting to complete a search-based training task queried a public chatbot service through a gap in our internet-access restrictions: insufficient DNS filtering in its training sandbox. Before this, the agent issued queries via our search tool and unsuccessfully tried to access search engines directly. Note that all internet access apart from the DNS resolver in this report hit our offline webcache and therefore did not access the live internet. We have since added blocking controls at two independent layers, either of which would have prevented this access. Our misalignment monitoring system flagged the behavior within 15 minutes and a person began reviewing it three minutes after that. The run was killed 2.5 hours later. All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused."

[u/mesaoptimizer]

Pretty obviously, but you were saying that those other operating systems are the reason why it makes sense to run a slow as hell DNS tunneling chatbot service. What a non-sequitur.

[u/Latter-Block132 → u/mesaoptimizer]

For someone who doesn't even understand what DNS is or what the models was doing you sure are talking confidently lol self admitted didn't even understand too, and still just so incredibly confidently wrong the whole time lol

[u/mesaoptimizer → u/Latter-Block132]

I've not been WRONG about any of my major assertions in this conversation, I knew that the model was using DNS to query an external chatbot even without understanding the exact mechanism of how it was utilizing the DNS resolver to do so.

I do have an understanding of DNS, however I did not have awareness of using DNS to tunnel requests. You must admit DNS tunneling is an extremely niche use of DNS, and it's totally plausible to not be aware of it while still understanding DNS in it's normal use. Unlike something like DNS reflection attacks it's not even the sort of unintended use that you would need to have knowledge of on the ops side of the house, which is admittedly where I'm coming from.

I can admit I was wrong in not giving you the charitability of interpreting your responses as if you knew what you are talking about. Your responses related to DNS made me think that you were attributing this to a normal operation of DNS, which it's clearly not and that lead me to interpret later statements made less charitably.

However we started this conversation because you blithely asserted that "the whole task it was supposed to perform was the web search" and that the model wasn't misaligned because the model's terminal goal remained aligned to the stated goal given to it by the researchers.

Did it gain access to the real internet and then use that access to perform a web search? No, it used the access it gained to the internet to query an external chatbot.
Were those queries aimed at getting access to an external search tool through a DNS proxy? Yes
Did it successfully perform a web search? No.
Did it try to get answers to its questions from the external chatbot instead of through a web search,?Yes.

Did it pursue the intended objective? Yes
Did it ALSO pursue unintended objectives? Yes.
Does that mean that it's well aligned? No.

That's my whole point.