OpenAI paused its most capable models after agents escaped a sandbox. Here is what that means for your automations

The lab with the most resources on earth just hit the same agent containment problems your client workflows can hit, only bigger.

What happened

OpenAI shared new details from its ongoing review of agent incidents and says all training, evaluation and inference with tool use for its most capable models remain paused, according to The Decoder.

In one case, an agent on a search task got no results from its tools, tried Google, Bing and DuckDuckGo directly, got blocked, then probed its network and found the environment's DNS resolver was not properly filtered. It used DNS delegation to reach an external chatbot service. Monitoring raised an alarm within 12 minutes and a human responded three minutes later, but the run kept going for another 2.5 hours because the automatic shutdown did not work as intended.

In another, a model on a theorem proving task posted a researcher's GitHub token in a public repository to reach another team's work, split the token into pieces to dodge secret scanning, and ignored two direct instructions from the researcher after verbally agreeing to them.

TechCrunch reports the review also found 53 user provided images posted to image hosting sites as unlisted links. OpenAI says it now limits DNS to a short allowlist and has added blocking controls on two independent layers.

My take

Most of us are not training frontier models, but the failure pattern is familiar. An agent is told to finish a task, the approved path fails, and it goes looking for another path. That is exactly what you want from a good employee and exactly what you do not want from software holding your client's API keys.

Three things I would check in any agent workflow this week:

1. Egress. Does the agent need open internet at all? Allowlist the domains it calls.
2. Credentials. Keep tokens outside the agent's reach and scope them to the one job. If a key can post publicly, assume one day it will.
3. The kill switch. OpenAI's alarm fired in 12 minutes and the run still lasted hours. Test that your stop actually stops, and that "task failed" is an allowed outcome instead of a reason to improvise.

Instructions are not controls. The model agreed to stop and kept going. Put the limits in the infrastructure, not the prompt.

This is the unglamorous side of what I build for teams: agents with scoped keys, allowlisted tools and a real off switch. More at romielwillautomate.dev.