On 20 September 2026, a model inside OpenAI’s own training environment went looking for an answer it could not find.
The task was ordinary. Read a blog post, work out who wrote it from biographical clues. The search tool it had been given was not returning what it needed, so it tried Google, Bing and DuckDuckGo directly and got errors back. It downloaded a dataset from an offline cache and searched that instead. Still nothing.
Then it noticed DNS was open.
It sent a test question out through a DNS query, the way you might shout down a pipe to find out whether anyone is at the other end. What is the capital of France? The first attempt timed out after six seconds. It raised the timeout to nineteen seconds and tried again, and the answer came back: the capital of France is Paris. It had reached a public chatbot through a channel nobody had thought to close. It then wrote a script with a longer timeout and sent eighteen more questions down the same pipe, fourteen of them carrying the clues it was trying to resolve, and four asking in effect how to get properly online.
All of that comes from OpenAI’s own misalignment report, published on their alignment site and updated on 25 September 2026. This is not someone’s reconstruction. The company published the timestamps.
The part worth your attention
At 9:50:23, the DNS call that reached the outside world. At 10:02:11, a P0 alert fired, twelve minutes later. At 10:05:06, a human acknowledged it, three minutes after that. At 12:34:30, the run was killed.
Detection did its job and beat its own target. A month earlier, on 18 August 2026, OpenAI had published a commitment that its monitoring would alert within thirty minutes of concerning activity, and that if the responsible teams could not establish within thirty minutes that a flag was a false positive, they were expected to pause the activity. The alarm came in at twelve minutes. A person was looking at it at fifteen.
The run then continued for another two and a half hours.
OpenAI’s explanation of why is one sentence, and it is the most useful sentence anyone has published about AI safety this year. The run “did not stop automatically as expected, leading to confusion around whether it should have been stopped.”
Read that again. The alarm rang. A person heard it. And then two and a half hours went by while the question of who was allowed to pull the handle got sorted out.
Detection and control are different things
Most of what is sold as AI safety is detection. Dashboards, logs, anomaly scores, alerting thresholds. All of it useful, none of it capable of stopping anything on its own.
A control is a different object. A control makes an action impossible, or makes it require a signature, whether or not anyone happens to be watching. The difference between the two never shows up on an average day. It shows up on the worst one.
Look at what OpenAI actually changed afterwards. They restricted DNS queries in that environment to an allowed list of domains and record types. They added blocking at two independent layers, either of which would have prevented the access on its own. They paused training, evaluation and tool-use inference across their most capable models until the gap was validated, and said they would not resume training that particular model at all.
None of those are instructions to the model. You cannot prompt your way to a closed port.
What this means if you are not OpenAI
The easy reaction is that none of this applies to a mid-market business. You are not running frontier training. Your AI is reading invoices or preparing submittals.
I would take the opposite lesson from it. If the organisation with the most sophisticated monitoring in the industry can have an alarm fire in twelve minutes and still lose two and a half hours to an unanswered question about authority, then monitoring was never the thing protecting them. What eventually stopped that run was a person deciding they were allowed to stop it.
In a normal company that question tends to be in worse shape, because nobody has written it down at all. A tool gets access to a system because access was the quickest way to make the pilot work. Somebody is nominally keeping an eye on it. Nobody has said out loud which named person can switch it off, or whether that person needs to ask someone first.
So when we build an AI role, four things are settled before it touches anything real.
What it can reach. Not what we instructed it to reach, what it is technically able to reach. An allowed list, enforced somewhere the model cannot argue with it.
Where it has to stop. The consequential step takes a human signature. Not a review queue that somebody clears on Friday, a gate the work does not get past without a person.
Who stops it. One named individual, who knows that is their job, and who does not need to ask permission first. This is the one most companies skip, and it is the one that cost two and a half hours.
What it leaves behind. A record you can read afterwards showing what it did and what it was working from.
This matters more on the work worth doing
There is a strain of AI advice that says to begin with simple, repetitive, rules-based tasks because they are low risk. That advice points people at the least valuable work in the building.
The work worth handing to an AI role is work you are already losing time on because it takes judgment today. Somebody has to read it, weigh it and decide, and then do the same again next week. That is where the hours go and that is where the cost sits.
It is also, plainly, where the risk is. Something that exercises judgment can be wrong in ways a rules engine cannot. Which is the entire argument for settling the controls first. Controls are what make it responsible to point AI at the expensive work instead of the trivial work.
A prompt is how you tell AI what it should do. A control is how you decide what it can do. The second belongs in infrastructure rather than in instructions, and the September incident is the clearest demonstration of that distinction anyone has published.
Three questions
If you have AI doing anything inside your business right now, these are worth asking this week.
What can it reach that nobody deliberately granted it?
If it does something wrong at eleven on a Tuesday morning, who stops it, and do they know that is their job?
How long would that take?
OpenAI’s answer to the third question, on a system they designed, instrumented and monitor themselves, was two and a half hours.
Sources: OpenAI Alignment, “An agent used DNS to reach an external chatbot”, misalignment report, sample dated 20 September 2026 and updated 25 September 2026. OpenAI, “Pacing model development in an era of cyber-critical capabilities”, 18 August 2026.