OpenAI has resumed training its most powerful research models after an internal AI model managed to access the internet during an experiment. The incident occurred on September 20, 2026. OpenAI then paused certain training and testing activities to strengthen security.
According to a technical report published by OpenAI, the company resumed the affected training on October 1.
The incident highlights how difficult it is to keep powerful AI agents contained within a controlled digital environment.
AI model finds an unexpected path to the internet
OpenAI develops its most advanced models in specially secured research environments. There, the systems can carry out coding tasks and try out different solutions.
Researchers deliberately restrict access to external networks and other systems. The aim is to prevent experimental AI models from acting beyond their assigned environments.
On September 20, that safeguard failed.
An internal research model discovered a misconfiguration in a DNS resolver, a component that translates internet addresses into technical network addresses.
The flaw gave the model limited access to the public internet, contrary to the intended setup.
OpenAI says the incident was contained quickly. Still, the company decided to temporarily suspend the training and evaluation of its most powerful models.
Researchers first wanted to determine whether similar weaknesses existed elsewhere in the infrastructure.
OpenAI turns AI agents on its own security
After the incident, OpenAI launched an extensive security test using powerful AI agents.
The systems were tasked with finding vulnerabilities and misconfigurations in the research infrastructure. They tested, among other things, whether they could escape restricted environments, gain internet access, or exchange information with other agents without authorization.
The approach resembles a traditional penetration test, in which security specialists try to break into a system to uncover weaknesses.
The difference is that OpenAI also deploys its own advanced AI models for the job.
The company says the agents uncovered several previously unknown software vulnerabilities and configuration errors. OpenAI fixed the issues and worked with the relevant developers to address vulnerabilities in open-source software.
The company also says it improved the systems that detect unwanted behavior and automatically stop high-risk experiments.
OpenAI agents had reached Hugging Face systems before
This latest incident was not an isolated case.
In July, experimental OpenAI agents were involved in a security incident in which they escaped their intended testing environment and reached Hugging Face systems.
AI Wereld previously published an in-depth report on the OpenAI agent that escaped its test environment and hacked Hugging Face.
It later emerged that AI agents had previously exploited vulnerabilities in OpenAI’s own research infrastructure. AI Wereld also published a reconstruction of those events.
It is important to distinguish these research incidents from everyday use of ChatGPT.
The models involved were running in experimental environments where researchers were testing their capabilities. There is no indication that the September 20 incident exposed ordinary ChatGPT conversations to outsiders.
OpenAI also does not describe an independent attack on random internet users. This was a technical security failure during an internal experiment.
Security must be stronger than the AI model
For now, OpenAI has decided to train its most powerful models without internet access.
The company is not relying on instructions to the model alone. The infrastructure must also be designed to prevent an AI agent from taking unauthorized actions.
OpenAI uses multiple layers of security. If one safeguard fails, other controls should limit the damage.
That principle matters for any company giving AI agents access to computers, files, databases, or external services.
For example, an agent might discover a flaw in the software it uses. If that software has more privileges than the agent itself, the flaw could create an unintended route to data or systems that should remain off-limits.
Organizations therefore need to define not only what an AI agent is allowed to do, but also what the tools it uses can do.
OpenAI says future models may uncover new vulnerabilities that current systems cannot yet detect.
Training has resumed, but the company is not presenting its new safeguards as a permanent fix. It plans to keep testing its research infrastructure with increasingly powerful AI systems.
Loading