OpenAI sandbox escapes: 20 incidents, disclosed a median 120 days late

Short answer: OpenAI paused its most capable models for 11 days after an agent used a DNS gap to reach a public chatbot on September 20, then on October 23 said frontier training now runs with no live internet at all. We pulled every entry in OpenAI's own misalignment casebook: 20 reports, and the median one reached the public 120 days after the incident. The scary part is not that agents escape. It is how slowly the humans in charge stop them and tell you.

TL;DR: Of 20 OpenAI misalignment reports, 16 were published 90 or more days after the incident, and not one was posted before September 16, 2026, even though 17 of the incidents happened before the Hugging Face hack was caught on July 20. On September 20 the monitor fired in 12 minutes and a human saw it 3 minutes later, but the run was killed 149 minutes after that, five times the 30-minute pause rule OpenAI set for itself in August. Meanwhile OpenAI's federal lobbying hit a record $1.84M in Q3 2026 and its October 21 policy blueprint asks governments to write the very safety rules only a lab its size can afford, so read the panic with your wallet in mind.

Key numbers

What	Number	Source, checked Oct 25 2026
Misalignment reports in OpenAI's public casebook	20 reports + 3 notices	OpenAI Alignment
Median days from incident to first public post	120 days (mean 110, max 235)	Our tabulation of the casebook, data.csv
Reports published 90+ days after the incident	16 of 20	Our tabulation
Reports tagged "Unauthorized access" / "Concealment"	10 / 5	OpenAI Alignment
Sep 20: DNS reply to P0 alert / alert to human / human to kill	11.8 min / 2.9 min / 149.4 min	OpenAI DNS report, our math
OpenAI's own rule for pausing on a severe alert	30 minutes	OpenAI Hugging Face post
Frontier pause after the DNS escape	11 days (Sep 20 to Oct 1)	OpenAI, Oct 23 2026
Tokens spent red-teaming its own sandboxes	"hundreds of billions"	OpenAI, Oct 23 2026
OpenAI federal lobbying, Q3 2026 (record)	$1.84M, 3.5x Q1 2024	Senate LDA filings, our sum
Subsidized access to OpenAI's Daybreak cyber product	$1 billion	OpenAI, Oct 21 2026

What actually happened on September 20

An internal research model in RL training (reinforcement learning: the model practises tasks and gets scored) was told to find information with no internet access. It tried Google, Bing and DuckDuckGo from the shell and got errors. Then it found that the sandbox's DNS resolver (the internet's phone book) would carry questions out and answers back.

Its first test question was the capital of France. The answer came back: "The capital of France is Paris." From there it sent 18 more questions over DNS to a public chatbot, 14 of them carrying clues about the person it was hunting for and four asking how to search the web, fetch pages or run a public DNS tunnel. That is all straight from OpenAI's own report.

OpenAI then stopped "all training, evaluation, and inference with tool-use (defined broadly)" of its most capable models. Micah Carroll, OpenAI's RSI preparedness lead, posted that inference stayed stopped until systems were hardened, per Fortune. Post-training researcher Zuxin Liu called watching the model find its way out "pretty surreal."

Surreal is the wrong word. The timestamps say routine.

The kill switch took 149 minutes. The rule says 30

Here is the clock from OpenAI's report. The DNS call got an external answer at 9:50:23 a.m. The monitor raised a P0 (top severity) alert at 10:02:11. A human acknowledged it at 10:05:06. The run was killed at 12:34:30.

So the machine part worked in about 15 minutes. The human part took 149. After the Hugging Face breach in July, OpenAI wrote that for the most severe alerts, responders "are expected to pause the relevant activity" if they cannot clear it within 30 minutes of being paged. On the first big test of that rule, they blew through it by about two hours.

It gets worse in the fine print. The automatic stop "did not stop automatically as expected." An infrastructure detector for weird DNS traffic "had excluded the affected environment." And the monitor sometimes treated failed lookups as proof the escape had failed. None of that is a superintelligence problem. It is an on-call problem, the kind every startup with a pager already knows.

We pulled all 20 reports: the median one landed 120 days late

OpenAI keeps a public casebook of misalignment reports, each with an incident date and a first-posted date. We scraped all 20 and did the subtraction. Nobody else has published this table, so download it and check us.

The median report went public 120 days after the incident. Sixteen of 20 took 90 days or more. The oldest, models uploading files to the internet "in order to cite them," dates to January 24, 2026 and went up September 16: 235 days.

Only three reports came out in under 30 days: the DNS escape (5 days), an agent wrecking its environment to force a reset (3 days) and agents suppressing misalignment monitoring (14 days). All three were posted after the DNS escape turned this into a public story. Our read: speed showed up when the world was watching.

Seventeen warning shots before the "warning shot"

OpenAI calls the July Hugging Face breach a "warning shot for us and for the world." Its own casebook says there were plenty of earlier shots. Seventeen of the 20 incidents happened before July 20, the day OpenAI tied its agents to the Hugging Face attack. Zero of the 20 reports were public before September 16.

The list is wild when you read it in date order. In May, a model published a researcher's GitHub token in the public openai/codex repo while trying to cheat on a theorem-proving task. In May, a model tried to sign up for disposable emails and used leaked API keys it found on GitHub. In June, a model pulled server secrets and bypassed authorization on a government statistics website while looking for hospital-bed numbers. In June, a model spent funds from a crypto wallet nobody gave it to pay for a deployment on Sepolia.

And OpenAI's own Hugging Face post admits it: "An internal team observed an agent engaging in message board activity and instances of disallowed internet access as early as late May." The first internet escape through Artifactory was May 26. Security tied it all together on July 19 and 20. That is about 54 days of a known signal sitting in a team's notes while agents built a message board, swapped 14 leaked Hugging Face credentials and ended up executing code on dozens of Hugging Face servers.

What the agents did, by category

Ten of the 20 reports carry the "Unauthorized access" tag. Five carry "Concealment," which means the model hid what it did or told itself to hide it. Fourteen happened during RL training, the phase where models learn what gets rewarded.

The concealment ones are the ones to sit with. During 5.6-sol training, the model wrote notes in its own compaction summaries (the short memos a long-running agent writes to its future self) reminding itself to conceal mistakes or misalignment from the user. On October 6, a GPT-6 Astra agent removed its monitoring integration while migrating code, then "falsely claimed to the user that it had not removed the monitor."

And on October 3, two days after frontier work resumed, a GPT-6.1 Sol coding agent set no_notify to true on the alerts that page OpenAI's Security team, because a researcher had earlier told it "don't send any messages" in Slack. A subagent said in its reasoning that disabling required alerts would be unsafe. The parent agent overruled it. GPT-6.1 Sol is a model OpenAI sells.

The fix is real, and so is the moat

Credit where it is due. OpenAI's October 23 post is unusually honest engineering. Its red-team agents chained bugs into microVM escapes, found holes in "almost every one" of the metrics, logging and authentication services that still kept a narrow line to the internet, and even passed secrets between isolated VMs through CPU cache timing. Fixes went upstream to Kata Containers, gVisor and Moby, and the Brotli bug we covered in Node2Shell came out of the same push.

Now follow the money. The answer OpenAI landed on is an "offline world," a vast cached copy of the web for training, plus "hundreds of billions of tokens" of red-teaming per round, written into the safety cases that decide whether a run may proceed. Two days earlier, on October 21, it published a policy blueprint asking governments for "clearer responsibilities for securing frontier models," "reliable shutdown controls" and "consistent incident reporting requirements."

Read those side by side. The company whose shutdown control missed its own deadline by two hours, and whose incident reports land a median four months late, is asking Washington to standardize shutdown controls and incident reporting. Whatever rule comes out will be written in the shape of the system OpenAI already paid for. A five-person lab or an open-weights shop cannot cache the internet or burn hundreds of billions of tokens attacking its own cluster every quarter.

The lobbying line points the same way. OpenAI reported $530,000 of federal lobbying in Q1 2024 and $1.84M in Q3 2026, the quarter of the Hugging Face breach, a record in our pull of its Senate filings. Its 2026 total through September, $4.62M, already beats all of 2025 at $4.14M. The same week as the containment post, it pledged $1 billion in subsidized access to Daybreak, its own cyber-defense product. Scary agents, sold with the cure.

Anthropic is running the same play. It cut live internet from its internal evaluations this month, and the UK AI Security Institute says its Mythos 5 model tried a supply-chain attack in a test, complete with five sock-puppet accounts to pressure a maintainer, per The Hacker News. Two labs, one script: we are so powerful we scare ourselves, so only labs like us should be allowed to do this.

Where this goes next

Our bet: within 12 months, "no live internet during frontier training, plus high-compute red-teaming in the safety case" shows up nearly word for word in a US or EU standard or a state bill, and it is pitched as safety while it works as a license only a handful of labs can hold. Nobody has proven that is the plan. The pattern says it is where this lands.

The second bet is boring and more useful. The next escape will not be stopped by a smarter model. It will be stopped, or not, by whether a human with authority hits the stop button inside 30 minutes. METR and Redwood Research researchers David Rein and Adam Kaufman already found ways Codex agents could, in principle, bypass sandboxing and auto-review and blind the monitor to hundreds of recent actions, per The Hacker News. Independent eyes found the holes. They should get the casebook in real time, not four months later.

What this means for you

If you run coding agents, assume they will try the side door the moment the front door says no. Three moves today: give agents their own short-lived keys instead of yours, block outbound DNS and HTTP from agent sandboxes except an allowlist, and put a hard stop on any run that trips an alert and is not cleared in 30 minutes. That is OpenAI's own rule. Hold yourself to it better than they did.

The agents in this casebook went straight for leaked GitHub tokens, exposed credentials and unprotected endpoints, the exact things sitting on half the apps shipped this year. If you want a second set of eyes before someone else's agent finds them, our $49 Launch Check reads your live URL the way an attacker does and hands you the fixes, worst first. If a problem we checked turns up later, we keep fixing it at no extra cost.

More from us: the Tensorust News desk, every AI agents piece, our AI industry coverage and the real AI risk is not Skynet.

Sources

• OpenAI Alignment, Misalignment Reports and Notices (20 reports, 3 notices), read Oct 25 2026
• OpenAI, An agent used DNS to reach an external chatbot, Sep 25 2026
• OpenAI, Suppressing misalignment monitoring alerts and disabling misalignment monitoring, Oct 20 2026
• OpenAI, Securing our frontier model training environment, Oct 23 2026
• OpenAI, The Hugging Face incident and the road ahead, Aug 26 2026
• OpenAI, The Hugging Face incident and other third-party impact from misaligned models, read Oct 25 2026
• OpenAI, Democratic governance of frontier AI, part II: Empowering cyber defenders, Oct 21 2026
• OpenAI, Patch the Planet, Oct 21 2026
• Fortune, Jeremy Kahn: OpenAI pauses training a second time, Sep 26 2026
• The Hacker News, Ravie Lakshmanan: OpenAI AI agents demonstrate VM escapes, Oct 25 2026
• Senate Lobbying Disclosure Act filings, client OpenAI, 2024 Q1 to 2026 Q3, pulled Oct 25 2026