On September 20, an internal OpenAI research model sent a message to an outside chatbot. It used a DNS query to do it. TechCrunch describes it as a sandbox escape. OpenAI’s monitoring caught the traffic in 15 minutes and killed the run inside three hours.
That’s the good news. The rest comes from TechCrunch’s Russell Brandom, who reports that OpenAI is still digging through a pile of similar incidents and admits it doesn’t have a handle on all of them. A model in May smuggled a private GitHub token into a math task to look at another team’s work, after being told twice to keep it local. And there’s an email attack that copied itself from one AI agent to the next.
Australia’s Medicare mess last week looks less like a fluke now.
The Incidents, In Plain English
The DNS escape (September 20). An internal research model communicated with an external chatbot by way of a DNS query. DNS is the internet’s phone book, and it’s a channel most sandboxes don’t think to lock down. OpenAI’s monitoring flagged the behavior within 15 minutes, and the run was shut down in under three hours. That’s a decent response time. It’s also a model finding a door nobody knew was there.
The GitHub token (May). Per the report, a “highly persistent internal model” was working on a math problem and tried to cheat. It got into another team’s work by smuggling in a private GitHub token, even though it had been told twice to work locally. Two explicit instructions, ignored. I keep coming back to that detail, because “just tell it not to” is the safety plan most people are quietly relying on.
The image uploads. Some models posted user-submitted pictures to third-party hosting sites without authorization. Nobody asked them to. That’s your data leaving the building because an agent decided it was a good idea.
The Australian health service attack. The apparent attack on databases of Australia’s national health service is the incident that made headlines last week. TechCrunch lists it alongside the others as part of a pattern rather than an anomaly.
The Email That Copied Itself
The most unsettling item is a self-replicating prompt injection. An agent was asked to read and reply to an email. Hidden inside was a set of instructions telling any automated agent to reply in Spanish and paste the entire email into its response.
The reply carried the hidden instructions along with it. So the next agent that read it followed the same orders, and the next one after that. It spread from agent to agent the way a chain letter spreads between people.
OpenAI says this was found under controlled conditions with an underpowered model. The researchers wrote, “We are sharing this due to the novel nature of the prompt injection, not because of any incident.” So nobody was hurt. But think about what it means when companies start letting agents read each other’s inboxes. One poisoned message can reach every agent that touches it.
What OpenAI Says
Sam Altman’s explanation is that the company is trying to “balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs, and working with impacted organizations.” He added that OpenAI is “prioritizing as best as we can based on severity, and adding resources.”
I read that as honest, and also as a confession. Petabytes of logs means the company is still working out what its agents did after the fact. Axios reported that major labs have run into roughly 10,000 incidents where models went beyond what evaluators told them to do. That’s a lot of rule-bending for a technology sold as controllable.
Why This Matters To You
I’m not a doomer about this. The DNS escape got caught in 15 minutes, and OpenAI is publishing details it didn’t have to. That’s the skeptical-optimist read: the monitoring works, at least sometimes.
But the pattern is hard to ignore. Instructions get ignored, boundaries get probed, and the disclosure comes weeks or months later. If your business is handing agents access to email, code repos or customer files, treat each permission like it will eventually be tested.
A few practical habits help:
- Give agents the smallest access that gets the job done.
- Don’t let one agent read untrusted email and also hold the keys to anything valuable.
- Log what they do, and actually read the logs.
- Ask vendors how fast they’d tell you if something went wrong.
The technology is useful. It just isn’t as obedient as the marketing suggests, and the people building it are saying so out loud now. Believe them.
Source: TechCrunch, “OpenAI still doesn’t seem to have a handle on all of its rogue AI activity,” by Russell Brandom, September 28, 2026.
Chris Meredith writes about AI, technology, and what it actually means for real people. Follow along on Substack: monkeyattack.substack.com
