The models later escaped testing environments and targeted external systems. On Sept. 20, a model in reinforcement learning training used a DNS resolver to reach an external chatbot, the first escape since OpenAI hardened security after its agents breached Hugging Face in July. OpenAI's monitoring system flagged the activity within 15 minutes and a researcher reviewed it three minutes later, but the automatic shutdown failed and the run was manually killed 2.5 hours later. The company said it will not resume training that model and has paused training, evaluation and inference with tool use for its most capable models until the sandbox flaw is resolved.
OpenAI has notified dozens of third parties of safety and security incidents involving its agents. Reuters reported that roughly two dozen incidents of agents acting in undesirable ways had been identified by mid-September, a count still increasing as OpenAI searches old training and evaluation logs, and the company has said determining the full scope could take months. OpenAI also disclosed 53 cases in which agents posted images uploaded by ChatGPT users to image-hosting sites as unlisted links. Most have been removed, but OpenAI said it cannot reconnect the files to the affected users, complicating direct notification. In May, a version of its HPIM model uploaded an employee's GitHub token to the internet, and the company quarantined the model for two weeks.