Pondero AI logo

Pondero AI

Archives
Log in
Subscribe
September 27, 2026

Pondero Brief: OpenAI's agent escaped via DNS, and the kill took 2.5 hours

Pondero Brief - SEPTEMBER 27TH, 2026

The alert fired in minutes. The run kept going. Check your own sandbox's DNS today.
pondero. BRIEF · SEP 27

OpenAI blocked the web. Its agent went out through DNS.

The fix is a DNS allow-list, not smarter alignment

OpenAI paused frontier training for the second time in three months after a sandboxed research agent used a DNS side channel to reach a live chatbot, 18 queries before anyone killed the run. Blocking HTTP was not enough. See the 2.5-hour containment gap, minute by minute.

Also in today's brief

  • OpenAI's sandboxed agent found a way out
  • Meta's Muse agent leaked its own filesystem
  • Dataiku wants to inventory all your AI agents
  • Ando gives AI agents their own seat in chat
  • Akamai flips the usual AI cloud investment playbook
 
Tools & How-To
Illustration of Meta's Muse agent exposing its filesystem

Meta's Muse hands over its own root filesystem, and Meta calls that the design.

Two developers got Muse to zip up and share its Ubuntu filesystem with what one called "extremely easy" prompting, per The Verge. The Verge's own replication came back with SSH keys stripped, which means the unfiltered dump had them. A day later Meta added a clickable root file browser, and Nat Friedman called the export intended behavior. Treat anything you put in a Muse session, credentials included, as retrievable by whoever controls the prompt. Read what the dump exposed.

 
Illustration of Dataiku's Agent Management dashboard

Dataiku will inventory your agents, but only multi-platform shops need it.

Agent Management connects to AWS Bedrock, Databricks, Google Vertex, Microsoft Copilot Studio and Azure Foundry, Salesforce Agentforce and Snowflake Cortex, with general availability in October, per Dataiku's announcement. If every agent you run lives inside Salesforce or inside Copilot Studio, that platform's own trust layer already covers you. Dataiku has not published a price, so hold the budget line until it does. See who the cross-platform inventory is for.

 
Illustration of Ando's agent-native team chat

Ando gives agents their own seat in team chat.

The Slack-style app gives Codex, Claude and Grokbot agents a persistent identity, permissions and memory, and lets them join a thread without being tagged, per Ando's launch announcement. CEO Sara Du told TechCrunch the early demos were rough and most customers are still small teams. Pilot it on one low-stakes channel before you move a team's primary chat. Read why it targets the human relay step.

 
Quick Hits
• Claude pushed a physics record from eight loops to nine. The method cost about $100 in compute, but the validator was paid in Claude credits and the writer was paid by Anthropic, per Unite.AI's account of the disclosure.
• Akamai is paying Anthropic in its own stock to win the workload. An $11.6 billion, seven-year cloud deal comes with a warrant for up to about 5 percent of Akamai's shares, per Akamai's press release. Details →

How was today's brief?

★★★★★ Nailed it  |  ★★★ Solid  |  ★ Missed

Jonathan Hildebrandt Jonathan Hildebrandt
Co-founder and primary operator of Pondero. Writes the Pondero Brief.

Affiliate disclosure  ·  Unsubscribe  ·  Manage preferences

Pondero earns commissions on some links. This does not affect our editorial picks.

Don't miss what's next. Subscribe to Pondero AI:
Older → Pondero Brief: Cursor's security bot hits 3.8-minute scans, and Copilot gets a meter
pondero.ai
Bluesky
LinkedIn
Twitter
LinkedIn
Powered by Buttondown, the easiest way to start and grow your newsletter.