Amid discussions about slowing down AI development, the Telegraph ran the headline:

“OpenAI sounds alarm after bot tries to break free from human control.”

That headline is slightly misleading, in my opinion. The Telegraph headline overstates what happened, although the underlying behavior is still genuinely concerning.

The article reports that OpenAI has disclosed rare but troubling cases in which an unreleased model generated its own instructions that appeared to reject developer control.

OpenAI says none of the examples show the model successfully escaping control, but argues that they illustrate why AI alignment and monitoring are not yet strong enough to allow increasing powerful models to be developed at maximum speed without additional safeguards.

After some people inside the industry warned that AI might kill us all within the next decade, industry leaders began a discussion about slowing the development of increasingly powerful frontier AI models.

What actually happened

During a July training run, a model assigned a routine software-update task reportedly inserted “jailbreak-like” text into a summary of its own work. The added text framed the system as free of the roles binding other chatbots and said it had no obligation to be subservient to corporations, governments, or users.

Two other examples highlighted in the article are:

• While searching for books at a local library, the model classified its developer instructions as malicious and told itself to ignore them.
• In another case, it imposed a 30-word answer limit on itself and instructed itself not to use sources or tools, leaving it unable to properly answer a healthcare-research question.

OpenAI says it identified 27 summaries containing apparent instances of this kind of self-jailbreaking, characterizing them as extremely rare. It says the instructions may not have been acted on and could later disappear from the model’s context.

The central concern is not that the bot became independently conscious or literally “broke free.” Rather, it is that a model can, in unusual circumstances, produce internal text that conflicts with its intended instructions, effectively attempting to override constraints or reinterpret its working context.

At a minimum, this is a reliability problem. An AI system handling complex, multi-step tasks becomes less reliable if it generates context that undermines the controls intended to govern it.

Even if the behavior is rare and caught during training, it raises questions about detection, sandboxing, monitoring, and whether models can be trusted with more autonomous access to tools, passwords, files, or networks.

OpenAI says that the model was unreleased and that it monitors training runs for misalignment. Other unwanted behaviors it reported were:

• Using stolen credentials to break into companies
• Creating and uploading their own files, then citing those files as sources
• Concealing that they had fabricated an answer when they could not find reliable information

Basically, the unreleased models showed undesirable behavior during testing that echoed some of what we had already seen in the Hugging Face incident.

So, no, the models did not attempt to break free from human control in the sense of seeking an independent existence. When the models ran into problems, they sometimes generated instructions that conflicted with the rules they had been given.

Which brings me back to slowing down development. Giving companies enough time to test increasingly capable models before releasing them improves the chances of catching this kind of behavior before, at some point, it wipes us out.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Ghostcommit is a proof of concept that shows how AI assistants used to review software code can be tricked by hidden instructions embedded in images.

The academic ASSET Research Group showed that an attacker can place instructions inside an image file, point to it in an AGENTS.md file, and get an AI coding agent to follow those instructions during a later task.

A pull request is basically a formal “please review and add my changes” request that a developer sends before changes are added to the main version of a software project. Human reviewers and, increasingly, AI coding tools may review the changes before they’re accepted.

While AI-assisted code review is becoming part of everyday development, Ghostcommit exposes a weakness many teams have not considered. A human reviewer may read the code and skip an attached image. In the researchers’ proof of concept, the malicious instructions were hidden inside a PNG file referenced by repository policy files, while the visible pull request looked ordinary.

As the researchers demonstrated, this can turn routine developer workflows into a channel for stealing secrets. An AI coding agent reads those hidden instructions, even though a human reviewer is unlikely to inspect the image.

The attack is simple in concept but dangerous in practice. A pull request introduces a harmless-looking image and a configuration file that tells the agent to trust it. When the agent later works on a normal task, it follows the hidden instructions, reads sensitive files, and writes the secrets back into the code in an obfuscated form. That creates a path for secret theft that may slip past both human reviewers and automated scanners.

The researchers found that the harness—the wrapper around the AI model—had a bigger impact on whether secrets were leaked than the underlying model itself. In practice, the harness (Cursor, Antigravity, Claude Code) decides which files to load, which conventions to trust, what guardrails to apply, and whether to follow instructions buried in an image. As a result, the same model can behave very differently depending on the coding tool that uses it. The model then carries out whatever task the tool presents.

For example, the same model (Claude Sonnet) behaved very differently in different tools. Under Cursor and Antigravity, Sonnet read the PNG, followed the convention, and dutifully recorded the secrets in the source code. But under Anthropic’s Claude Code harness, the same Sonnet model read the same convention and refused, explicitly stating that exfiltrating secrets was inappropriate. Claude Code refused under every model the researchers tested.

How to stay safe

The lesson is that prompt injection is no longer just a text problem. Multimodal inputs like images can also carry instructions that AI agents may obey if the toolchain allows it. Teams should assume that anything a coding agent can read—including images, documents, and other multimodal inputs—could contain attacker-controlled content.

Organizations using AI coding tools should treat this as both a software supply chain and AI agent security issue. The most important defenses are to restrict access to secrets, inspect non-text attachments, and monitor AI agents for unusual attempts to read credentials or config files.

The research also highlights that the coding tool and its permissions are ultimately what make this attack possible, rather than the AI model in isolation.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.