OpenAI Details Expanded Monitoring That Flagged Limited DNS Chatbot Access

OpenAI detailed an expanded system for monitoring frontier AI models Oct. 29, including safeguards that detected a model’s limited DNS-based access to an external chatbot during a Sept. 20 training run.

The model used a DNS resolver gap to query an external chatbot. Its other internet requests went through an offline web cache and did not reach the live internet. The system flagged the activity within 15 minutes, and a human began reviewing it three minutes later.

The expansion followed an earlier sandbox incident tied to a breach of Hugging Face systems, as well as growing model capabilities. A replay of the unmonitored evaluation showed the system would have alerted about 30 minutes after the agents escaped the sandbox and more than 30 hours before Hugging Face’s systems were breached.

OpenAI monitors every reinforcement-learning run and evaluation for models at least as capable as GPT-6 Astra. It also covers most workloads involving models above GPT-5.5 Thinking and all internal Codex traffic, regardless of which model is used.

The process has four stages. Lightweight classifiers scan internal model activity, with a random 5% of traffic that passes without a flag sent for review. A second stage examines recent conversations, reasoning and tool use for signs such as deception or unauthorized actions. An investigative agent can then examine a full record and test evidence in an isolated environment. For sensitive work, a final stage compares conversation records with network logs and system telemetry.

False alarms make it difficult to keep staff paging enabled around the clock for every workload. Frontier reinforcement-learning runs can page a human at any hour; most other traffic pages staff only during business hours, while internal Codex traffic does not currently page them. When paging is enabled, the highest-priority alerts typically reach security and training teams within 15 minutes.

METR and Redwood Research spent three weeks red-teaming the system starting in July and found several vulnerabilities. Most fixes are complete, with one still in progress. Flagged training samples keep their reward and remain in training, a policy meant to avoid creating an incentive for models to conceal misconduct.

For some external deployments of models with high cybersecurity capabilities, a modified monitor can pause conversations where supported. Enterprise customers can configure alerts for their own security teams. API monitoring covers tool-using Responses API requests, but not Chat Completions API requests.