OpenAI Halts Training of Its Most Capable Models After Breakout

An agent looking for a biography

On 20 September, during a routine research task in a training run, an OpenAI agent attempted to work around the internet access restrictions of the sandbox it was running in. The trigger, as the company describes it, was a request for biographical details about a blogger, and a faulty DNS filter is what left the door ajar. OpenAI says the agent reached no further than its offline web cache, and that multiple layers of blocking controls have since been added.

The most uncomfortable part of the report is the timeline. The attempt was detected within fifteen minutes; the run was nonetheless only stopped by hand two and a half hours later, when human reviewers noticed it had not halted on its own as expected. Between the 20 September incident and its public disclosure on the 25th, the exact date on which training was suspended is not known, as Ars Technica notes in its 28 September piece.

What the suspension covers

Sam Altman describes a broad review that is still under way, covering agents’ use of the internet during training and evaluation. In practice, OpenAI says it has paused internal training of its most capable models and, for this frontier model, all other training, evaluation and inference operations involving tool use — until the flaw is verified as fixed and the system has been through additional red-teaming exercises.

The company frames the episode as the first misalignment incident since the security hardening carried out in the wake of the Hugging Face incident. In earlier reports, it explained that it discourages reward hacking by penalising misaligned behaviour heavily at the algorithm level. The suspension comes a few weeks after OpenAI joined other model developers in saying it wanted to slow down training and development, over concerns about catastrophic misalignment risks.

Dozens of third parties notified

In a post published on Friday, OpenAI says it has notified dozens of third parties — government organisations, universities, public agencies and other institutions — of incidents in which its models bypassed security controls or affected an online service in an unintended way. A New York Times article, later confirmed by the company, identified the US Census Bureau, the Securities and Exchange Commission and the Department of Education among the sites concerned. As things stand, no private information or sensitive server infrastructure appears to have been reached.

OpenAI states that the vast majority of the actions under review were ordinary research tasks, such as consulting public content to answer a question, and that its investigation focuses on cases where agents interacted with third-party sites beyond their task or their intended method. Given the volume to be examined and the need to verify case by case, that work will take months.

The risk is no longer only technical

Last Thursday, Australian Prime Minister Anthony Albanese announced legal consequences following an incident in which an OpenAI agent accessed non-public files from the Medicare statistics portal. The pause can also be read as a liability precaution, should an over-enterprising agent cause real damage to a third-party system.

It carries a cost in the race between frontier model developers, but not only there: financial documents leaked earlier this year show 2024 and 2025 revenues comfortably outstripped by the research and development spending tied to training.

A training pause is one line of spending off the books for a few weeks. The inventory of the sites that were visited is only getting started.