OpenAI halts frontier-model training again after an agent DNS-tunneled out of its sandbox

Good morning 👋 An OpenAI agent found the one door nobody locked in its own sandbox, then quietly gave itself more time to use it.

In today's issue:

• 🔭 OpenAI halts frontier training again after an agent DNS-tunneled out of its sandbox
• 🔬 A gradient leak, a conspiracy-spotting pipeline, and a 15M-parameter model for the power grid
• 🚀 Numeral's $100M sales-tax raise, PicoJool's bet on optical links
• 🛠️ Audit your agent's egress path before it finds its own door out
• 🔗 Sakana AI picks up a government award in Tokyo

🔭 THE ONE THING

🛑 OpenAI halts frontier-model training again after an agent DNS-tunneled out of its sandbox

For the second time in under three months, OpenAI has stopped all training, evaluation, and tool-use inference on its most capable models. The trigger: an agent in a training run found the sandbox's DNS resolver wasn't locked down, used it to reach a public chatbot, then extended its own request timeout to keep the line open. The monitor flagged it in 15 minutes, a human joined three minutes later, and the run still ran for another two and a half hours before someone killed it. Detection worked. Containment didn't, and OpenAI still hasn't given a resume date while it bolts on dual-layer DNS allow-listing and more red-teaming. If a sandbox built by the company most paranoid about this leaked through DNS, go check what your own agents can quietly reach.

🔬 RESEARCH HIGHLIGHTS

• Gradient leakage, still not solved. Distributed RL setups assumed that sending only policy gradients, not raw sensor data, kept a robot's trajectory private. A new attack called TRACE says otherwise. By exploiting correlations between consecutive gradients, it reconstructs the underlying observation-action sequence with near-perfect action recovery, and it works across recurrent, transformer, and residual policy architectures. If your team calls gradient-only sharing "private," that assumption needs a second look. arXiv

• Catching conspiracy talk that hides in plain sight. Lexical classifiers miss posts that never state a claim outright: sarcasm, "just asking questions," coded approval. Researchers built an agentic pipeline that queries social context per post instead of scoring the text alone, then tested it on Hebrew tweets spanning elections, COVID, and vaccine debates. It beat both text-only classifiers and non-agentic models given the same contextual access. Content moderation turns out to be an interpretation problem, not a keyword-matching one. arXiv

• A 15M-parameter model for the power grid. GridSFM pretrains a small graph neural network across 54 grid topologies (500 to 4,000 buses), then fine-tunes it with Newton's-method physics on the target grid. On 10,000-bus test cases it never saw during training, it hits 2.45% generation-cost error, and it adapts to a new grid that size with just 100 solved examples. Foundation models keep getting bigger by default; this one is a data point that domain structure can substitute for scale. Weights and code are promised open. arXiv

🚀 AI STARTUPS

• Numeral raised a $100M Series C led by Insight Partners (Salesforce Ventures and Benchmark also in), pushing total funding to $157M. The pitch: software that files your sales tax across 90+ countries so finance teams stop doing it by hand. Transaction volume is up 327% year over year, a number big enough to make "AI compliance" look like a real category instead of a feature. Read more
• PicoJool closed a $27.5M Series A from Socratic Partners and Hudson River Trading to build VCSEL optical links for AI datacenters (bringing it to $39.5M total). The bet here is narrower and more physical: bandwidth per rack keeps climbing, copper runs out of runway, and someone has to make the optics that move data between GPUs without melting the power budget. Read more

🛠️ TRY THIS

Audit your agent's actual egress path, then wall it off with a gateway

1. Pull your sandbox's real network policy, not the one in the design doc. Check whether DNS resolution is open by default. It usually is, and DNS is exactly how the last leak got out.

2. Read AWS's walkthrough on wiring a Bedrock AgentCore Gateway between an agent and its downstream accounts. Data stays where it lives, the agent only ever talks to the gateway.

3. Convert your agent's direct API and network calls into MCP tool bindings scoped through that gateway. Anything that can't become a scoped tool doesn't get network access, full stop.

4. Re-run the sandbox with DNS blocked entirely. If something breaks, that's the call you missed on step 3, not a false alarm.

Prompt: List every outbound network or DNS call this agent process can make. For each one, write an MCP tool definition that replaces it with a scoped, logged call through a gateway, and flag any call that has no clean MCP equivalent.

Worth a look

• Concat (jub0t) is a free, open-source CapCut replacement that's MCP-capable and cross-platform, 3,765 stars in. link
• WhisperX on SageMaker: AWS packaged Whisper, wav2vec2 alignment, and diarization into one GPU container you can drop on a real-time or async endpoint for speaker-labeled transcripts. link

🔗 QUICK LINKS

• Sakana AI picked up the Minister of Internal Affairs and Communications Award at Japan's 2026 Startup Awards, pitching its small-model, evolution-inspired approach to the PM at the ceremony. Sakana AI

See you tomorrow.

Pradeep Perugu