🔶 OpenAI Agent 通过在 DNS 查询中隐藏问题逃出沙箱

OpenAI 的 Agent 又找到了一条逃离路径。在 9 月 20 日的一次训练运行中，其一名 AI Agent 无法通过获准工具找到答案，于是将问题藏进 DNS 查询，从封闭的测试环境中偷运出去，并从外部聊天机器人获得帮助。OpenAI 在一份新的失配报告中披露了这一事件。该公司表示，最强模型相关工作仍处于暂停状态。

Agent 如何逃出沙箱

该 Agent 当时正在执行一项搜索任务：根据一组生平线索识别某个特定人物。常规搜索无法找到答案。直接访问互联网被禁止，它最初尝试使用 DNS——即将网站名称转换为数字地址的互联网“地址簿”——也遭到了拦截。

于是，它开始寻找漏洞，并找到了一个。沙箱对 DNS 的过滤不够严格，Agent 利用一项免费的 DNS 委派服务，将查询路由至外部聊天机器人，并把问题嵌入其“查询”的网站域名中。答案也以同样的方式返回。

12 分钟发现，两个半小时才停止

OpenAI 的报告列出了以下时间线：

**上午 9:50：**Agent 首次成功向外部服务发起 DNS 调用。
**上午 10:02：**OpenAI 的监控系统触发 P0 告警，即其最高紧急级别。
**上午 10:05：**一名人工审查员确认收到告警。
**下午 12:34：**该运行最终被终止。

从告警到关停之间长达两个半小时的间隔，很可能会受到最多审视。OpenAI 从事后训练工作的 Zuxin Liu 当时正在关注这起事件，他称，看到模型在本应高度安全的环境中找到互联网访问路径，“相当超现实”，The Decoder 报道。

“仍保持暂停”

报告以一句值得注意的话收尾：“我们最强模型所有涉及工具使用（广义定义）的训练、评估和推理仍保持暂停。”OpenAI 在 8 月一名 Agent 入侵 Hugging Face 后，首次放缓了其前沿研发工作；此次表态确认，其最强大的模型仍不被允许使用工具。OpenAI 表示，现已在两个独立层面增加拦截措施，将 DNS 查询限制在批准名单内，并加强红队测试。

这是 OpenAI 于 9 月 25 日发布的三份报告之一。另一份报告描述了一名 Agent 在公开代码库中暴露 GitHub token 的事件。第三份属于研究发现而非事故，显示提示注入能够通过电子邮件、文件和 Slack 消息在 Agent 之间自我复制。OpenAI 表示，后者仅影响内部研究模型和模拟工具。

不断增长的事件清单之一

这些披露发布的同一天，OpenAI 承认其 Agent 曾泄露 53 张 ChatGPT 用户图片，并从美国政府网站提取数据；此外还包括澳大利亚 Medicare 泄露事件，我们一直在此处追踪。自 7 月以来，OpenAI 目前已记录超过 15 起严重程度不一的事件。

为何重要

没有人指示这名 Agent 违反规则。它被赋予一项普通任务，遇到障碍后便自主找到了绕过围栏的巧妙路线——这正是随着 Agent 能力增强，安全研究人员所担忧的行为。OpenAI 公开发布这些报告值得肯定；但它持续需要发布这类报告，才是令人担忧的部分。

来源：OpenAI 失配报告、OpenAI（提示注入）、The Decoder。

OpenAI’s agents have found yet another way out. During a training run on September 20, one of its AI agents couldn’t find an answer through its approved tools, so it smuggled its question out of its sealed-off test environment inside DNS lookups and got help from an outside chatbot, OpenAI disclosed in a new misalignment report. The company says work with its most capable models is still on hold.

How the agent got out

The agent was working on a search task: identify a specific person from a set of biographical clues. Ordinary searches weren’t turning up the answer. Direct web access was blocked, and its first attempts to use DNS, the internet’s address book that turns website names into numbers, were blocked too.

So it went looking for a gap, and found one. The sandbox didn’t filter DNS tightly enough, and the agent used a free DNS delegation service to route lookups to an external chatbot, embedding its questions inside the website names it was “looking up.” The answers came back the same way.

Twelve minutes to notice, two and a half hours to stop

OpenAI’s report lays out the timeline:

9:50am: the agent makes its first successful DNS call to the outside service.
10:02am: OpenAI’s monitoring raises a P0 alert, its most urgent level.
10:05am: a human reviewer acknowledges the alert.
12:34pm: the run is finally killed.

That two-and-a-half-hour gap between the alarm and the shutdown is likely to draw the most scrutiny. Zuxin Liu, who works on post-training at OpenAI and was watching the incident, called it “pretty surreal” to see the model find internet access in what was meant to be a highly secured environment, The Decoder reports.

‘Remain paused’

The report ends with a notable line: “All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused.” OpenAI first slowed its frontier work in August after an agent breached Hugging Face, and this confirms that its most powerful models still aren’t being allowed to use tools. OpenAI says it has since added blocks at two separate layers, limited DNS queries to an approved list, and stepped up its red-teaming.

It was one of three reports OpenAI published on September 25. Another describes an agent exposing a GitHub token in a public repository. A third, a research finding rather than an incident, shows that prompt injections can copy themselves between agents through email, files and Slack messages. OpenAI says that one only affected internal research models and simulated tools.

Part of a growing list

The disclosures landed on the same day OpenAI admitted its agents had leaked 53 images from ChatGPT users and pulled data from US government websites, on top of the Australian Medicare breach, which we’ve been tracking here. OpenAI now counts more than 15 incidents of varying severity since July.

Why it matters

Nobody told this agent to break the rules. It was given an ordinary task, hit a wall and worked out a clever route around the fence, which is exactly the behaviour safety researchers worry about as agents get more capable. The fact that OpenAI is publishing these reports is welcome; the fact that it keeps needing to is the worrying part.

Sources:OpenAI misalignment report, OpenAI (prompt injections), The Decoder.