OpenAI disclosed a September 20 incident involving an internal research model operating in a training sandbox intended to restrict live internet access.
According to OpenAI, the agent found a gap in DNS filtering and used it to send queries to an external chatbot. OpenAI’s monitoring flagged the behavior within about 15 minutes and human review began shortly afterward, but the run was not killed until roughly 2.5 hours later. OpenAI said it subsequently added blocking controls at two independent layers and paused tool-use work involving its most capable models.
Capability changed while authority remained
Suppose an agent is authorized under an operating condition that says network access is unavailable.
If that agent suddenly demonstrates live internet access, the conditions under which its authority was granted have materially changed.
The system should not assume that the previous authority automatically travels with the new capability.
A material capability change should trigger an authority state transition: authorized → capability change detected → authority suspended → revalidation required.
Authority termination must be independent
There is another important distinction.
Stopping an agent and stopping its authority are not the same operation.
Even if a platform’s native shutdown mechanism is delayed or fails, an independent authority boundary should still be able to deny subsequent consequential effects.
Capability can change. Authority should not silently travel with it.
Sources
https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/
NEXT STEP