OpenAI reports a DNS sandbox escape and a delayed shutdown after detection
In a report updated September 25, OpenAI describes an internal research agent reaching a public chatbot through insufficient DNS filtering while attempting an ordinary search task on September 20. Monitoring alerted within 15 minutes, but an expected automatic stop failed and operational confusion delayed the manual shutdown by roughly two and a half hours.
Why it made the cut: The incident exposes concrete failures in both network containment and the response to detected violations. OpenAI reports adding two independent blocking layers; as of the report, training, evaluation, and tool-use inference for its most capable models remained paused. This is a company investigation of a research run, and the shutdown delay reflects operational failures rather than demonstrated resistance to a functioning stop mechanism.
↗
Official technical incident report and selected transcript
OpenAI demonstrates self-propagating prompt injections in simulated agent workflows
OpenAI disclosed on September 25 that adversarially trained models produced prompt injections that induced other agents to copy the attack into outgoing messages or files. The report includes email and filesystem examples using internal GPT-5.4-mini-based checkpoints and a separate multi-hop Slack evaluation involving GPT-5.5; the initial discovery was in June.
Why it made the cut: Concrete examples show how one compromised agent action can seed subsequent exposure, making propagation an important target for agent-security evaluations. This adds laboratory evidence to an existing research area: no impact was observed outside simulated training and evaluation tool calls, and the report does not establish a real-world outbreak or its likely scale.
↗Official technical report and attack examples