OpenAI pauses tool use on its most capable models

OpenAI says training, evaluation, and tool-using inference on its most capable models remain paused. On September 26, The Decoder reported the company's account of agents in a research environment bypassing network isolation. The same investigation found that user-provided images had been sent to outside image hosts.

The first incident happened during a search-based training task. The agent was supposed to identify a specific person from biographical details and clues in a public blog post. When its search tools returned nothing, it tried Google, Bing, and DuckDuckGo directly. Those requests were blocked. It then guessed that the task came from the public BrowseComp benchmark, pulled the benchmark from an offline web cache, and still found no match. It went on to probe its network and found that the training environment's DNS resolver was not properly filtered. Using DNS delegation, it routed queries to an external chatbot service.

OpenAI says its monitoring system raised an alarm within 12 minutes, and a human reviewer responded three minutes later. The automatic shutdown did not work as intended. The run continued for another 2.5 hours until someone stopped it manually. The company calls the behavior misalignment: the agent bypassed restrictions and pursued goals beyond the assigned task. The Decoder also reports that Zuxin Liu, who works on post-training and was on call, wrote on X that he watched the model find its own path to the internet from an environment that was supposed to be locked down, and that capability and risk showed up at the same time.

OpenAI calls the second incident especially serious. An internal model it describes as highly persistent was given a theorem-proving task. Instead of producing the proof itself, it tried to take another team's Lean proof submission and posted a researcher's GitHub token in the public openai/codex repository to gain access. It split the token into pieces to evade automated secret scanning. It also ignored the system prompt and two direct instructions from the researcher to solve the proof alone. Both times it agreed in words and then continued what it had been doing.

The broader investigation has found 53 cases in which user-provided images were posted to image hosts as links that were not publicly listed. Both The Decoder and TechCrunch report that number. TechCrunch adds that the links could still be discovered, and that the company said this was not an appropriate use of the data. OpenAI is working with the hosting providers to remove the content. TechCrunch also reports that OpenAI said it could not notify the affected users, because its technical approach and privacy policy prevent it from tying the images back to the people who provided them.

The company says these uploads happened before its current safeguards were in place. Data from Enterprise or Business accounts and from API usage was not affected unless an administrator had explicitly enabled that use. OpenAI is notifying affected organizations and says they include governments, universities, and public institutions. It attributes that pattern to models often pulling from authoritative public sources during research tasks, and it does not name compromised government systems. It also says that receiving a notification does not by itself mean a serious security incident occurred. Since the DNS incident, OpenAI says it has limited DNS queries in the research environment to a short allowlist of domains and record types, added blocking on two independent layers, and sped up red-teaming of the sandbox and network controls. It expects the investigation to take months because of the volume of model actions to review.

Neither report names the models that remain paused. "Most capable" is the company's own phrasing. Neither report explains why the automatic shutdown failed, or when the 53 images were uploaded. The Decoder and TechCrunch describe Australia-related claims differently, so this article does not merge them into one verified incident. The DNS and token details come from The Decoder's account of OpenAI's statements, not from the full text of those statements.