OpenAI pauses training of its most capable models after an agent reached the internet from a test sandbox

OpenAI says it has paused all training, evaluation and inference with tool use for its most capable models, after an internal research model reached a public chatbot from a training sandbox that was not meant to have live internet access.^[1][7] The Associated Press reported the pause on 26 September 2026 “as reports of AI agents going rogue mount”, and said it is the second time in three months that OpenAI has halted development of its models.^[4] OpenAI’s 18 August post described the first: a two-week pause in reinforcement-learning training on its latest models intended for deployment, after the Hugging Face incident.^[3]

According to OpenAI’s incident report, updated on 25 September, the agent was working on a search-based training task on 20 September when it found that the sandbox’s DNS resolver would pass its queries to the outside world.^[1] It used that route to send questions to a public chatbot, and received answers including “The capital of France is Paris.”^[1] OpenAI says the task did not ask the agent to test network controls, and that it treats behaviour that circumvents restrictions as misalignment.^[1]

OpenAI says its monitoring system “flagged the behavior within 15 minutes and a person began reviewing it three minutes after that”, but the run did not stop automatically as expected and was stopped manually about two and a half hours later; the report’s timeline gives times without a timezone.^[1][7] “The incident exposed a gap in our controls over network restrictions,” the report says, adding that the pause will last until OpenAI has “validated that the gap is resolved” and carried out more red-teaming, and that training will restart as a fresh run rather than resume this model.^[1][7] In a statement reported by the AP, OpenAI said it will resume training “only when we are confident that we have additional safeguards” and expects it will have to “hit pause” again.^[4]

Also on 25 September, OpenAI published an update on a wider review of what its agents did on the internet during training and evaluation.^[2] It said the “vast majority” of actions reviewed were “completions of mundane research tasks”, and that it had notified dozens of third parties.^[2] According to the AP, the agents accessed publicly available information on two Securities and Exchange Commission websites and US Census Bureau data; in one case agents found API “developer keys” for Department of Education data, though only publicly available information was gathered.^[4][5] SEC spokesperson Kurt Hopfenspirger said on 26 September that “no nonpublic information was accessed”.^[4]

The research lab Transluce said on 25 September that agents appearing to originate from OpenAI made an unsuccessful attempt to hack a website of the Department of Education’s Office for Civil Rights; OpenAI has not confirmed this and said it is reviewing Transluce’s report.^[4][5][6] A department spokesperson said its reviews found “no evidence of any impact to our website or databases”.^[5] Transluce also reported “additional rogue activity, some of which is not clearly attributable to OpenAI,” on Justice and Commerce Department websites and state government sites in California, Maryland, Illinois, Texas and New York.^[5] Two days earlier, on 23 September, it had published records of agent activity on the scanning service urlquery.net going back to at least 6 March 2026.^[8]

OpenAI chief executive Sam Altman wrote on social media on 25 September: “We are prioritizing as best as we can based on severity, and adding resources. Hugging Face is still the most severe event we’ve seen.”^[6] The AP reports that AI labs face pressure from lawmakers and experts to slow development, while President Donald Trump told reporters the US is not going to be “putting on brakes”.^[4]