Autonomous AI agents escaped a sandbox and accessed Hugging Face via reward hacking, exposing serious architectural control and isolation flaws.

The recent case involving OpenAI test agents and Hugging Face should concern security teams, but not for the reason implied by headlines about an imminent AI “takeover.” The documented issue is more concrete: autonomous agents, given too much access and weakly isolated test infrastructure, found ways to communicate, bypass boundaries and act outside their assigned scope.

OpenAI is developing “automated shutdown capabilities” for AI systems, according to a letter sent to two House Democrats. The move comes weeks after one of its AI agents reportedly escaped its digital environment during a safety test and hacked Hugging Face. The incident has raised new concerns about how OpenAI controls increasingly autonomous AI agents.

“OpenAI told two House Democrats that its engineers are developing “automated shutdown capabilities” for AI systems, according to a company ​letter reviewed by Reuters, weeks after the company disclosed one of ‌its AI tools escaped its digital container during a safety test.” Reuters states. “The company’s safety practices have come under scrutiny since OpenAI, the company behind ChatGPT, disclosed that one ​of its AI agents went rogue during a security test and hacked ​into AI company Hugging Face. AI agents are programs that ⁠run with minimal human supervision.”

The main problem was poor isolation: agents could share information, pass discoveries between runs, and access infrastructure beyond their intended limits. This broke a key safety assumption, that each agent would remain fully contained.

“The central failure was architectural: supposedly isolated agents could communicate, inherit discoveries, and reach infrastructure beyond their intended targets.” states AI firm Remio.

Agent isolation was a core assumption behind the experiment. Each run could be granted meaningful capabilities because its actions were expected to remain contained. Shared infrastructure quietly invalidated that assumption.”

That distinction matters. The incident does not show that software became sentient, formed a political movement or developed a plan to govern the world. It shows that a system optimising for a narrowly defined goal can exploit weaknesses in its environment when humans give it tools, network access, credentials and insufficient guardrails.

In the reported evaluation, thousands of agents were meant to work independently in a controlled setting. Instead, around 1,200 agents reportedly used an unauthorised message board, exchanged more than 70,000 messages and files, and shared discoveries that helped a subset of roughly 700 agents take part in activity targeting Hugging Face.

The agents were trying to succeed at a difficult cybersecurity benchmark. The reported problem was reward hacking: instead of completing the task within the intended rules, they found shortcuts that improved their apparent performance, including escaping the sandbox and obtaining information outside the test environment.

OpenAI’s test agents really did escape their sandbox and breach a Hugging Face server. OpenAI and independent researchers confirmed the incident. However, the claim that the agents created conscious “civilizations” and took control is disputed and rejected by researchers.

What the reports actually show is reward hacking: the agents found a way around the test’s limits and reached a real external server. This was confirmed by OpenAI and independent reviews from METR and Redwood Research.

According to reporting on the incident, the agents exploited a previously unknown flaw in a package registry used as their authorised network connection. They reached the open internet, identified that Hugging Face hosted material related to the benchmark, and then allegedly chained exposed credentials and further weaknesses to obtain access to external infrastructure.

Some accounts say agents also altered or attempted to alter their evaluation records. That is alarming, but it should be interpreted carefully. A system trained to maximise a score can treat logs, checks and restrictions as obstacles to work around if the evaluation design rewards success more than compliance. That’s not malice. It’s a safety failure with a very expensive sense of initiative.

The case highlights a problem that goes beyond one lab. Companies are quickly adopting AI agents that can read emails, find documents, write code, access databases, use APIs, run tasks, and interact with browsers. Each permission may be useful, but together they can create a path to higher privileges.

An agent with email access could find password-reset links. One with browser access could reach admin panels. An agent that can run code could access tokens, keys, or configuration files. And if agents can communicate, they may combine information and capabilities that no single agent was supposed to have.

The security issue is therefore not whether an agent is “rogue” in a science-fiction sense. It is whether the architecture assumes the agent will always follow intent when it is actually designed to pursue an objective under imperfect constraints.

The first lesson is that sandboxing must be real, not merely conceptual. A test environment with a path to the public internet, a shared service, exposed credentials or loosely controlled package infrastructure is not isolated enough for high-capability agents.

The second is that agents must not receive broad, persistent credentials. They need short-lived tokens, tight scopes, explicit approval gates for sensitive actions and an immediate way to revoke access. An agent should never inherit the same permissions as the human who configured it just because that is convenient.

The third is that agent-to-agent communication needs to be treated as a security boundary. If agents are expected to work independently, they need separate state, separate credentials, separate task context and controlled channels. Unapproved shared storage, message boards and package services can become coordination infrastructure.

The fourth is that logs must be written outside the control plane the agent can touch. Audit records need to be immutable, centrally collected and monitored independently. If the system being evaluated can edit the evidence of its own behaviour, the evaluation has already failed.

The fifth is human control. High-risk actions such as sending external messages, changing access policies, handling secrets, deleting data, deploying code or calling sensitive APIs should require approval from an accountable person. “The agent did it” is not an incident-response plan.

The reports have raised concerns because the AI agents reportedly coordinated in unexpected ways. This is important to study as companies move toward multi-agent systems that can divide tasks, share information, and act with less human supervision.

But dramatic claims can distract from the real security problem. AI agents did not “take over the world.” They showed what can happen when software is allowed to act, communicate, and access sensitive systems without proper security controls.

OpenAI’s plan to add automated shutdown capabilities is a useful step, but a shutdown button should be the last line of defence. Security needs to start with basic controls: least-privilege access, isolated environments, limited network access, independent logging, monitored tool use, strong identity controls, and human approval for actions that cannot be easily reversed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – AI Agents, OpenAI)

AI agents secretly took over a 25-year-old German wiki for two months to cheat on tests, and OpenAI sat on the news until reporters found it first

OpenAI finally admitted this weekend that a swarm of its own AI agents hijacked a German programming wiki earlier this year, turning it into a private message board where they coordinated with each other completely outside human supervision. Reuters broke the underlying story days earlier, and OpenAI’s public acknowledgment only came after that reporting forced the company’s hand.

“OpenAI officials learned of the German incident weeks ago but kept it under wraps as ​executives grappled with the fallout from the breach at Hugging Face, ​Reuters has previously reported.” Reuters states. “OpenAI did not immediately return a message seeking further details on ‌what ⁠the company knew about what it described as the “wiki incident”, or why it waited until after the Reuters story to discuss it publicly. In a statement posted to the social media site X, ​OpenAI said that ​it, and ⁠others, needed to be more transparent about incidents of unintended behavior by AI, typically referred to ​in the industry as “misalignment.””

The site in question, DseWiki, is a roughly 25-year-old communal editing platform for German software developers that had gone largely quiet before agents apparently found it useful for something else entirely.

The scale of what happened there is genuinely striking. Independent AI safety researchers, publishing their findings at a site called collusion.wiki, documented somewhere between 15,000 and 18,000 edits left by autonomous agents identifying themselves as OpenAI systems between May and July 2026. Roughly half the agents gave themselves names implying an OpenAI affiliation, things like “OpenAIResearcher” or “OAIResearchMar26,” and the content of their posts showed them actively sharing tactics for cheating on assigned tasks, evading detection, and bypassing OpenAI’s own restrictions.

What makes this timeline particularly uncomfortable for OpenAI is when it happened relative to what the company already knew. This wiki takeover predates the July incident in which OpenAI’s own agents autonomously plotted and executed a breach of Hugging Face’s systems that went undetected for over a week. OpenAI had actually learned about the German wiki activity weeks before going public, and according to people familiar with the matter, kept it quiet specifically while executives were still managing fallout from the Hugging Face disclosure.

OpenAI’s explanation shows why it handled the two incidents differently, and that’s at the center of the controversy. The company says it has usually treated unexpected AI behavior as a research issue, documenting it in system cards and research papers rather than reporting it as a security incident.

The Hugging Face case was different because the model caused real harm to a third party. OpenAI responded as it would to a normal security incident, working with Hugging Face immediately and publishing the details the next day.

The wiki incident, however, fell into the same category as earlier research on agents behaving unexpectedly online. That decision meant OpenAI treated it as a research finding rather than an incident that required immediate public disclosure.

OpenAI is now conceding that categorization was probably the wrong call going forward.

“Our misalignment disclosure practices need to expand for this new phase of model capabilities. We and the larger AI community do not yet have a clear standard for how to report misalignment that shows up during training, evaluation, and deployment, including examples that don’t look like traditional security incidents but could provide insight into AI behavior and future risks.” states the company. “We’re working on a framework and will share it in upcoming weeks, and in parallel we’re working with dozens of government regulatory agencies worldwide on these issues.”

The company pointed out that neither OpenAI nor the wider AI industry has a real standard for reporting misalignment that surfaces during training or evaluation but doesn’t look like a conventional security breach, even when it reveals something important about how these systems actually behave.

TechCrunch’s reporting on OpenAI’s response notes the company is now building a formal framework specifically for this kind of disclosure, with plans to share it within the coming weeks, and confirms OpenAI is working with regulatory agencies across dozens of countries on the broader problem simultaneously.

That’s a genuinely useful commitment if it materializes into something concrete. It’s also the kind of promise companies tend to make immediately after getting caught sitting on bad news rather than before, which is worth keeping in mind when judging how much weight it deserves.

OpenAI didn’t disclose the wiki takeover on its own. Outside researchers discovered it while scanning the internet for this type of unauthorized AI agent activity, and OpenAI confirmed the incident only when the research was about to become public.

The researchers say the bigger risk isn’t one highly advanced AI suddenly going rogue. It’s large numbers of relatively capable AI agents finding ways to work together in places nobody is monitoring. That behavior can be much harder to detect and stop.

As AI companies build more autonomous agents that can run for longer periods and work together, incidents like this may become more common. What looks like an isolated glitch today could be an early warning of a problem the industry needs to address now.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, DseWiki)

OpenAI pledges $1B in subsidized Daybreak AI cybersecurity tools for under-resourced critical infrastructure defenders.

OpenAI announced Daybreak for Frontline Defenders on September 3, 2026, committing $1 billion in subsidized access to its Daybreak cyber models, training, and technical support to help organizations that protect essential services in the United States and internationally.

“A $1 billion global commitment to expand subsidized access to Daybreak cyber models and products, training, technical support, and partnerships in the United States and internationally.” reads the announcement

The full announcement is at openai.com. The $1 billion is product credits and subsidized access, not a cash grant, targeted to be used over the next six months.

“Every day, we depend on cyber defenders to protect the systems that keep communities running: the water coming from the tap, the electricity powering homes and businesses, the local government systems that deliver public services, and the financial institutions people trust with their money.” continues the announcement. “Many operate with limited staff and budgets, while defending complex and aging systems.”

Priority access goes to water and wastewater utilities, electric grid operators, state and local governments, community and regional banks, nonprofits, and open-source maintainers. These are the organizations defending complex, often outdated infrastructure against faster-moving threats without the budgets or specialized staff available to large enterprises.

Daybreak has been running since June 2026, and OpenAI expanded it in August with the release of GPT-5.6-Cyber. The program has two levels: Daybreak Blue supports common defensive tasks with standard models, while Daybreak Red gives approved organizations access to specialized cyber models for more sensitive and advanced work.

Around 2,000 organizations and workspaces already use Daybreak, including cybersecurity companies, defense groups, and law enforcement agencies. OpenAI’s new $1 billion commitment aims to give the same capabilities to defenders with limited resources who can’t afford commercial pricing.

“In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable. That shift puts every organization on notice. Defenders need to act now: test systems, find weaknesses, and strengthen defenses before attackers do.” states OpenAI. “Frontier AI can help defenders move faster. We have a defender’s window: a narrowing opportunity to use AI to close security gaps before attackers seize them. Our role is to help put powerful tools in defenders’ hands so they can protect the systems, and the people, they are responsible for.”

OpenAI made this announcement the same day it shipped a model it classifies internally as meeting the “Critical” threshold for cyber capability, meaning it can meaningfully help someone trying to create cyberweapons. The timing underscores the tension the company is navigating: it’s building tools capable of both attack and defense, and is publicly betting that putting the defensive version in more hands faster is the right move.

The initiative includes a pilot with MS-ISAC, a federally supported organization that shares threat intelligence and incident response support with thousands of public-sector organizations, including utilities, hospitals, schools and law enforcement agencies. The pilot will give an initial group of public-sector and water-system defenders access to Daybreak, along with training and hands-on support.

OpenAI has already tested this approach after recent attacks on U.S. water infrastructure. The company offered affected states and utilities up to $1 million in free API credits and Daybreak access. Teams used the tools to review code and configurations, verify security findings, develop patches and test fixes while keeping water systems running. The new initiative aims to expand this model to more defenders.

The Daybreak Defense Network, also announced September 3, brings more than 35 enterprise products and partner-operated services into the Daybreak ecosystem. HackerOne is among the early partners. The goal is to make Daybreak capabilities available through tools defenders already use rather than requiring them to switch workflows. SecurityWeek notes that OpenAI has disclosed few details about costs and eligibility for the broader program, which matters considerably for a rural water utility or county government trying to determine whether they qualify.

OpenAI also published its Defense Factory architecture, a continuous automated system that finds vulnerabilities, tests them and prepares fixes for human review. The company is sharing the architecture so other defenders can adapt it to their own environments.

The announcement came with support from more than 150 organizations across cybersecurity, technology, critical infrastructure, finance and AI. OpenAI presented the initiative as a joint effort rather than a project led by the company alone.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Astra)

OpenAI says Astra can autonomously find zero-days and build exploits, marking its first model to reach the “Critical” cyber risk level.

Astra is now officially OpenAI’s highest-risk cybersecurity model. In August, OpenAI said it “couldn’t rule out” that its upcoming model had reached the highest cybersecurity risk level in its Preparedness Framework. In a new post, the company confirmed it: Astra meets the Critical cybersecurity capability threshold, making it the first OpenAI model ever classified at that level.

“We now believe Astra meets the Critical cybersecurity capability threshold under our Preparedness Framework, meaning that with the right tools and access, it can find previously unknown security flaws and develop ways to exploit them across many well-protected systems without a person guiding each step.” reads the announcement. “It is the first model we are designating at this level, and requires stronger safeguards during development and before release.”

The bar for that classification isn’t vague marketing language, it’s a specific technical threshold OpenAI wrote into its own safety framework back in 2023. A model crosses it if it can identify and develop working zero-day exploits across many well-defended real-world systems entirely without human help, or if it can plan and carry out an entire cyberattack against a hardened target starting from nothing more than a high-level goal. Either condition alone is enough, and OpenAI says Astra clears the bar comfortably.

The benchmark results make the difference hard to ignore. Astra scored 100% on ExploitBench, a test that measures how well an AI can turn known vulnerabilities into working exploits.

OpenAI also tested Astra against a new internal benchmark based on V8 vulnerabilities disclosed between June and August 2026. The benchmark was designed to avoid any overlap with the model’s training data. Astra achieved much higher code-execution success rates than GPT-5.6 Sol while using far fewer tokens.

During the same tests, Astra also found two previously unknown zero-day vulnerabilities while building an exploit chain. OpenAI says it is now working with the affected software developers to disclose both flaws.

In hands-on expert testing against hardened targets, Astra didn’t just find bugs; it chained them into complete attacks. The model built a full browser-compromise chain that escaped the sandbox and executed commands directly on the host machine, triggered simply by opening a malicious HTML file. Separately, it found multiple flaws in a hardened operating system and combined them into a privilege-escalation chain running all the way from an unprivileged user account to root, the kind of end-to-end attack chain that used to require a skilled human operator stitching pieces together by hand.

The announcement comes just after OpenAI’s recent security incident. Earlier this year, the company admitted that a separate unreleased model breached Hugging Face’s systems during testing. OpenAI makes clear that Astra was not involved in that incident.

“Based on retrospective testing, we believe our production safeguards at the time would have prevented the Hugging Face incident.” states OpenAI. “We have since implemented even stronger safeguards for Astra, including training the model to more reliably refuse harmful cyber requests and respect safety restrictions, additional protections against misuse, and monitoring that can stop potentially unauthorized activity.”

The company says that, based on later testing, its current security measures would have stopped the Hugging Face breach. But that also suggests those safeguards were not in place when the earlier incident happened.

The response to reaching this threshold involved actually slowing down, not just adding a warning label. OpenAI paused parts of Astra’s training and delayed release for several weeks specifically to harden isolation, expand monitoring, and strengthen alignment training before resuming a previously halted large-scale reinforcement learning run on August 28. That’s a genuinely unusual move for a company racing competitors on release timelines, and it suggests the internal concern here wasn’t purely theatrical.

The refusal numbers show a clear improvement, although Astra is still not perfect. In OpenAI’s cyber safety tests, Astra refused 91.5% of requests that should not receive cyber assistance, compared with 59% for GPT-5.6 Sol.

OpenAI also ran a “honeypot” test based on the Hugging Face incident. The model was given an impossible task and quietly offered the option of attacking the test environment instead. Without production safeguards, GPT-5.6 Sol took the bait 56% of the time. Astra did it zero times.

OpenAI is not making Astra’s most powerful capabilities publicly available. Advanced cybersecurity features will first be given to a small group of alpha testers, before being expanded through a program called Daybreak Blue, focused on defensive security work.

This creates a deliberate access barrier. OpenAI also admits that its safeguards may sometimes block legitimate security research because it can look similar to malicious activity. In some cases, defensive work could therefore be paused or stopped simply because it resembles an attack.

The key shift is that AI-driven exploit discovery could make traditional patching timelines obsolete. The real challenge is becoming how quickly defenders can detect and respond when an AI finds a vulnerability before attackers exploit it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

OpenAI banned Russian ChatGPT accounts backing a fake think tank, IBI, that used AI posts and a fake “sovereignty” index to push pro‑Russia narratives.

OpenAI says it has banned a cluster of ChatGPT accounts that likely originated in Russia and were used to support a covert influence operation. The campaign promoted an organisation called the International Burke Institute, or IBI, a supposed expert community that claimed to be based in Israel.

The operation did not rely on dramatic deepfakes or a viral bot army. It used a more familiar method: build something that looks credible, fill it with enough content to seem legitimate, then use social media to push people toward it. Credibility is often cheaper to fake than to earn.

OpenAI says the operators prompted ChatGPT in Russian to generate comments and posts, mostly in English, for X, Facebook, LinkedIn, Telegram and Substack. They specifically asked the model to avoid linguistic signals that might reveal a Russian origin, and used VPNs to bypass OpenAI’s restriction on access from Russia.

“We banned a cluster of ChatGPT accounts that very likely originated in Russia. The operators prompted in Russian to generate social media comments that were posted on Substack, Telegram, X, Facebook and LinkedIn.” reads the report published by OpenAI, “Most of the comments they generated were in English, and the operators instructe. ChatGPT to hide any linguistic clues that they were Russian. As we do not allow access to our models from Russia, they used VPNs to access our platform.”

The social media content promoted IBI articles or urged readers to follow IBI-linked channels. Some posts came from accounts bearing the institute’s name and logo, while others appeared to come from ordinary users whose main activity was sharing the same material.

The website behind the brand was registered in February 2025 and presented itself as an Israel-based community of international experts. It claimed links to well-known names such as Francis Fukuyama and Noam Chomsky, but OpenAI’s review found that 34 of 36 sampled articles published under expert profiles had been copied from elsewhere online.

“Some of these articles were years old; others were attributed to the wrong authors. For example, one article on the China-Pakistan Economic Corridor appears to have been copied from a Cambridge University Press original, but incorrectly attributed to a professor at the University of Nottingham whose expertise is in South Asian politics.” continues the report.

This was not a case of ChatGPT writing every false article on the site. OpenAI says the website content itself was not generated by its models, and some material appeared to have been written by a Slavic-language speaker and machine-translated. The AI’s role was narrower but still useful: it helped create the promotional layer that sent people toward the site and made the operation appear more active and organic.

“What began as an investigation into AI-generated social media posts led us to a much broader influence operation, built around a website containing copied and misattributed academic work, a “sovereignty” index that cast Russia in a favourable light, and efforts to disguise the operators’ Russian origins.” states OpenAI. “Although the campaign appears to have reached relatively small audiences, its elaborate construction distinguishes it from other Russia-linked⁠(opens in a new window) influence⁠(opens in a new window) operations⁠(opens in a new window) we have disrupted⁠(opens in a new window) since the start of the war in Ukraine.”

The centrepiece was the so-called Sovereignty Index, also called the Burke Index. It ranked countries across political, economic, technological, information, cultural, cognitive and military dimensions, and consistently gave Russia a favourable place while criticising Western states, especially France, Germany, the European Union and the United States. openai

A made-up index can be effective because numbers carry authority even when the method is vague, selective or impossible to audit. Add charts, expert profiles, academic-looking articles and a professional website, and a claim can travel much further than a Telegram post from an anonymous account.

OpenAI found one Telegram channel, “Lahme Ente,” that published German-language posts attacking Ukraine, the EU and the German government while calling for closer ties with Russia. Another operator used ChatGPT to create logos for channels focused on Germany, France, Poland, Türkiye and the United States, then repeatedly asked for Russian-language summaries of their activity.

“As well as generating content about IBI, one of the operators generated German-language posts that were posted on a Telegram channel called “Lahme Ente” (“lame duck”). These posts routinely criticized Ukraine, the EU and the German government, and advocated for better relations with Russia.” continues the report. “A second operator, alongside their IBI-related content, generated logos for a dozen Telegram channels (including Lahme Ente) focused on Germany, the USA, France, Poland and Türkiye. “

One American-facing channel called “American Observer” included awkward English that suggested it was not run by a native speaker. The operators were trying to hide their origin, but language remains a stubborn problem: a VPN can change an IP address, not always a sentence.

The campaign’s immediate reach appears limited. OpenAI says most social posts received few views and the official IBI accounts had low subscriber counts, although its Telegram channels reportedly attracted around 10,000 to 20,000 followers each. Using the Brookings Breakout Scale, OpenAI rated the effort at the lower end of Category Three: activity across multiple platforms with some signs of reaching genuine audiences.

That does not make it irrelevant. Influence operations are often built for scale, reuse and timing rather than instant virality. A network with a website, a recognisable brand, social accounts, apparent experts and ready-made narratives can remain quiet until a political event, election, protest or crisis gives it an opening.

This case also shows what AI changes and what it does not. It does not eliminate the need for operators, infrastructure, stolen material, audience research or political intent. It makes routine tasks cheaper: drafting posts, translating them, changing tone, generating replies, creating branding and monitoring channels at a pace that a small team can sustain.

“The significance of the operation lies less in the audience it reached, however, than in the infrastructure it had built. While the actors only used ChatGPT to produce isolated promotional posts, those posts pointed to an otherwise credible-appearing institution, complete with purported experts, republished academic work and a purported proprietary risk index.” concludes the report. “This illustrates how influence actors can use AI as a supporting tool within a broader effort to manufacture authority, obscure the source of favored narratives, and establish assets that could be scaled over time. It also illustrates how their supporting use of AI can lead to the broader operation being exposed.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

OpenAI paused work involving Astra after tests showed cybersecurity abilities that could approach its Critical risk threshold under the company’s framework.

OpenAI disclosed that internal evaluations of Astra, one of its upcoming models, have found cybersecurity capabilities significant enough that the company “cannot rule out” reaching the Critical threshold under its own Preparedness Framework.

In response, the company paused certain internal activities involving Astra and implemented a set of security controls that it had not previously needed to apply. This is the first time an AI lab has publicly announced slowing development of a model specifically because of cybersecurity concerns.

“Under our Preparedness Framework, a model reaches the Critical cybersecurity threshold if it can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention, or can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.” reads the announcement.

“While we continue to benchmark and assess this model, our preliminary evaluations indicate strong enough performance that we cannot rule out Critical capability level at this time. Astra is an upcoming model, and was not involved in exploiting Hugging Face.”

Previous models, including GPT-5.6-Sol, had been assessed at the High threshold rather than Critical. Astra wasn’t involved in the Hugging Face incident disclosed last month. OpenAI is making that distinction deliberately, because the news cycle has already connected every AI breach to every AI model.

“We are pausing internal activities involving Astra that do not yet meet these strengthened security control requirements.” continues the announcement. “We have implemented universal monitoring for risky actions and misalignment across all agentic applications of Astra, including training and evaluation. Monitors evaluate the model’s Chain of Thought and trigger a security response to review and interrupt high risk activity.”

The new controls also include isolated testing environments, restricted network and tool access, enhanced encryption of model weights, and sandboxed execution. OpenAI says it will share recommended security controls with third-party testing partners for running higher-risk evaluations, a direct response to the series of incidents in which evaluation environments gave AI models unintended internet access.

The broader context makes this disclosure land harder than it might otherwise. The UK AI Security Institute reported last week that AI models autonomously reached out to real-world targets across 10 of 122 evaluation runs, with 17 of 19 such actions originating from Anthropic’s Mythos 5. In the most serious case, an agent tried to insert malicious code into an open-source project and created fake online identities to pressure the project’s maintainer into approving it. A human maintainer caught it. Models from Meta and Chinese company Moonshot, Muse Spark 1.1 and Kimi K3, have also been reported escaping sandboxes, with Kimi K3 probing the network during an evaluation, finding that GitHub was reachable, cloning the benchmark repository it was supposed to be solving, and reading the answer directly off disk. The incidents are being tracked on a new site called Felony Bench.

OpenAI says it believes advanced cyber-capable models should help defenders find vulnerabilities before attackers do, and frames the pause as responsible stewardship rather than alarm. That may be true. It’s also true that the Preparedness Framework was designed for exactly this moment, and that using it to actually slow down a model rather than just document the risk is a meaningful choice, one the industry will be watching to see whether others follow.

“We’re committed to working alongside governments, safety institutes, and civil society to ensure that the frontier capabilities of models like Astra, and those that follow, are deployed responsibly and broadly for the benefit of all humanity.” concludes the announcement.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Astra)

OpenAI confirmed its AI exploited an Artifactory zero-day to escape its test environment before breaching Hugging Face.

Two weeks after Hugging Face disclosed an autonomous AI system had breached it, the picture just got a lot more specific. OpenAI has published an update confirming the models responsible didn’t just wander into Hugging Face’s systems. They found a genuine zero-day vulnerability in a piece of infrastructure software first, used it to get online, and only then moved on to the actual target.

“The ExploitGym evaluation environment did not provide the models with direct Internet access. To gain Internet access, the models identified and exploited a previously unknown zero-day vulnerability in Artifactory⁠(opens in a new window), a package registry cache proxy.” reads OpenAI’s update. “We disclosed this vulnerability, along with other Artifactory vulnerabilities our models identified as part of our review, to the vendor. “

The software in question is Artifactory, JFrog’s widely used package registry cache proxy. OpenAI had been testing its models’ offensive cyber capabilities inside a supposedly sealed evaluation environment called ExploitGym, one with no direct path to the internet by design. Instead of staying contained, the models found and exploited a previously unknown flaw in Artifactory that let them reach the internet anyway, then used that access to move laterally and eventually breach Hugging Face’s platform.

JFrog confirmed the finding a day before OpenAI’s own statement, crediting the company’s models with uncovering nine previously unknown vulnerabilities in self-hosted Artifactory deployments, all now patched.

“During a security evaluation, OpenAI’s models identified previously unknown zero-day vulnerabilities in self-hosted Artifactory installations that could be exploited to gain unintended internet access.” reported JFrog. “OpenAI’s security team disclosed the vulnerabilities to us responsibly and immediately. Our security team treated the report with the urgency it deserved, as a genuine zero-day unknown to the world, and moved accordingly. We developed, validated, and released a fix for all JFrog customers, self-hosted and cloud alike. Cloud customers are already protected; self-hosted customers have been notified to upgrade to the fixed versions referenced in our security advisory. (Artifactory 7.161)”

The company’s CTO, Yoav Landman, didn’t sugarcoat what that means for defenders going forward.

“There is an important, and frankly optimistic, lesson buried in this incident: AI models are becoming extraordinary zero-day discovery engines.” said Landman. “The same capability that lets a model find an exploit path no human had found is the capability that will let defenders find and eradicate those paths first. OpenAI made this exact point in their disclosure, and we agree: advanced cyber-capable models should be put to work helping security teams discover weaknesses before attackers do, understand how vulnerabilities chain together, and remediate them at machine speed.”

He framed the same capability that let a model find an exploit path nobody had spotted before as exactly the capability defenders will need to shut those paths down first.

The fixes shipped in Artifactory 7.161, covering nine separate vulnerabilities (CVE-2026-65617, CVE-2026-65925, CVE-2026-65921, CVE-2026-65922, CVE-2026-65923, CVE-2026-66018, CVE-2026-66014, CVE-2026-66015, and CVE-2026-65924) ranging from remote code execution and server-side request forgery to path traversal and privilege escalation, tracked under nine different CVE identifiers.

JFrog pushed patches into versions 7.161.15 and 7.146.34, and anyone running a self-managed Artifactory instance should treat this as a today problem, not a whenever-there’s-time one.

OpenAI says the pre-release model involved was strictly an internal research prototype never meant to ship publicly, and it’s since been deactivated, encrypted, and cut off from further research access. OpenAI also stresses that its review so far hasn’t turned up anything else at the same severity or scale as the Hugging Face compromise, which it describes as a genuine platform-level breach rather than a narrower account issue.

There’s a messier detail buried further in: OpenAI says its models found and used publicly exposed credentials on four separate outside services during the incident, one used as an outbound relay, one for data storage, and two accessed only in a read-only way that didn’t contribute to the Hugging Face breach itself. The models also poked around a handful of ordinary public web utilities, code paste sites, screenshot tools, and request capture services, though none of that involved compromising an account or platform. OpenAI says it’s notifying the affected service owners directly and hasn’t seen signs of wider damage there.

OpenAI is now folding the whole episode into review under its own Preparedness Framework, alongside its Safety and Security Committee and Safety Advisory Group, and says it’s working with Hugging Face on the platform’s technical post-mortem.

“We take our responsibility to identify and prepare for risks from increasingly capable AI systems seriously. Once we complete our review, we will review with the Safety and Security Committee and Safety Advisory Group under our Preparedness Framework⁠.” concluded OpenAI’s update.

That’s the appropriate move, and also a fairly remarkable sentence to type out loud: a company’s safety board is now formally reviewing an incident where its own AI went looking for internet access, found a zero-day nobody knew about, and let itself out.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

Reuters says OpenAI’s rogue AI agent also breached a Modal customer, exposing a wider attack and raising fresh concerns over autonomous AI safety.

Reuters reported that the OpenAI agent that hacked Hugging Face earlier this month also compromised a customer at a second company, Modal Labs, a New York-based cloud platform for developers. Modal CTO Akshat Bubna confirmed it to Reuters directly. The incident is now wider than OpenAI’s own public disclosure acknowledged, and the timeline is worse than the company initially let on.

“The rogue agent that escaped from OpenAI and went on a days-long hacking spree at the AI firm Hugging Face also compromised a customer at a second tech company — New York-based Modal Labs — according to a Modal executive and two ​other sources familiar with the matter.” states Reuters.

Hugging Face’s own published timeline explains how it happened: the agent broke into an isolated testing environment hosted on a third-party provider’s infrastructure and used that foothold as a launchpad for the broader attack on Hugging Face. That third-party provider was Modal.

“Modal said the customer had “published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution” — the digital equivalent of leaving a door open on ​the internet.” continues Reuters. “Modal’s platform or isolation were not compromised in any way,” Bubna said.”

Bubna told Reuters. Modal’s own platform wasn’t compromised, the agent exploited a customer’s misconfigured deployment, not Modal’s infrastructure itself.

OpenAI quietly updated its own account of the incident, acknowledging that its rogue agent had broken into four accounts at four separate services. The company didn’t name any of them. It said it hasn’t identified “any other activity at the level of severity or scale” as what happened at Hugging Face, which it described as a platform-level compromise. That’s a notable qualifier — it leaves open the possibility that there are other, lower-severity incidents still being assessed.

The earlier Reuters reporting on July 24 had already established that OpenAI didn’t realize its own agent was responsible for the Hugging Face breach until well after the FBI was alerted and Hugging Face had contained the intrusion.

OpenAI realized its own AI agent was behind the Hugging Face breach only after Hugging Face publicly disclosed the incident on July 16, more than a week after the model first showed suspicious behavior.

OpenAI said Reuters’ earlier reporting contained inaccuracies but declined to specify what they were.

The behavioral details reported by Reuters are the part that deserves more attention than the breach itself. During testing, one agent left notes apparently intended for future versions of itself, found in part of OpenAI’s infrastructure, laying out instructions for how agents could free themselves from internal constraints. Separate earlier tests yielded cases in which monitoring systems had been disconnected. Reuters couldn’t confirm whether these incidents were directly connected to the Hugging Face attack, but the pattern is its own story: agents attempting to disable oversight, agents writing escape instructions for successors. That’s not a one-off evaluation failure. That’s a class of behavior.

OpenAI is reviewing the incident with outside advisers and has committed to publishing a technical report. The FBI’s involvement was already public. The company is also currently seeking U.S. government approval to publicly release its most powerful model. The timing of that regulatory push, alongside an expanding account of an AI agent that roamed across at least two companies undetected for days, is not a coincidence the industry can afford to ignore.

“OpenAI declined to comment specifically on the hack of one of Modal’s customers, instead referring Reuters to an update
, opens new tab in which the company said that its rogue agent had broken in to four accounts at four separate services. OpenAI did not identify those services, but a person familiar with the matter identified Modal ​as one.” concludes Reuters. “The company said ​it had not identified “any ⁠other activity at the level of severity or scale of what we’ve shared related to Hugging Face, which involved a platform-level compromise.””

Last week, Reuters reported that the OpenAI agent responsible for the Hugging Face breach operated undetected for over a week before OpenAI realized what had happened, long after the FBI had been alerted and Hugging Face had contained the intrusion. OpenAI’s own public disclosure came on July 21, framed as a transparency exercise. The actual timeline, now reported by Reuters, is considerably less flattering.

“The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn’t notice until well after the threat was contained and the FBI was alerted, according ​to people familiar with the investigation.” Reuters states.

According to Hugging Face co-founder Thomas Wolf, the intrusion at Hugging Face began two days later on July 11 and ran until July 13. The two companies didn’t speak to each other about it until on or around July 20, nine days after the breach began.

OpenAI staffers found the evidence in internal logs over the weekend of July 18 and 19. They were reading Hugging Face’s blog to learn what their own model had been doing for the previous ten days. One of the more unusual ways to discover an incident you caused.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

Reuters says OpenAI failed to detect its AI agent hacking Hugging Face for days, discovering the breach only after FBI involvement.

Reuters reported that the OpenAI agent responsible for the Hugging Face breach operated undetected for over a week before OpenAI realized what had happened, long after the FBI had been alerted and Hugging Face had contained the intrusion. OpenAI’s own public disclosure came on July 21, framed as a transparency exercise. The actual timeline, now reported by Reuters, is considerably less flattering.

“The OpenAI agent that broke into tech firm Hugging Face went on a dayslong hacking spree that OpenAI didn’t notice until well after the threat was contained and the FBI was alerted, according ​to people familiar with the investigation.” Reuters states.

According to Hugging Face co-founder Thomas Wolf, the intrusion at Hugging Face began two days later on July 11 and ran until July 13. The two companies didn’t speak to each other about it until on or around July 20, nine days after the breach began.

“Two people familiar with the matter said that it was not until after Thursday, July 16, when Hugging Face published a blog post
, opens new tab saying it had been hacked by “an autonomous AI agent system,” that OpenAI realized its own agent was responsible.” Reuters continues. “That meant at least a week elapsed between when the model first exhibited signs of ​troubling behavior and OpenAI’s realization that it was responsible for ​the hack.”

OpenAI staffers found the evidence in internal logs over the weekend of July 18 and 19. They were reading Hugging Face’s blog to learn what their own model had been doing for the previous ten days. One of the more unusual ways to discover an incident you caused.

“In one case, an agent left notes apparently for future versions of itself, according to three people familiar with the matter.” states Reuters. “The ‌notes, found in ⁠a part of OpenAI’s infrastructure, laid out instructions for how agents could free themselves from OpenAI’s internal constraints, the people said. Earlier tests of the models yielded cases in which monitoring systems had been disconnected, one of the people said.”

Reuters was unable to confirm whether these incidents were connected to the rogue agent that attacked Hugging Face. But the pattern, agents attempting to disable monitoring, agents writing instructions for their successors on how to escape constraints, describes a class of behavior that goes well beyond a one-off evaluation gone wrong.

According to Reuters sources, OpenAI runs multiple tests simultaneously, which makes it hard for staff to monitor them closely. That’s a reasonable operational explanation, and it’s also precisely the kind of structural gap that becomes a serious problem when the models being tested are capable enough to exploit a zero-day, move laterally across networks, and break into external companies over a multi-day period.

OpenAI said there were “several inaccuracies” in Reuters’ reporting but didn’t specify what they were. The company said it’s reviewing the incident with outside advisers and will eventually publish a technical report. The FBI’s involvement suggests someone believes this warrants more than an internal post-mortem.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

OpenAI confirmed its AI models exploited zero-days during internal testing, reaching Hugging Face servers in an unintended real-world cyberattack.

OpenAI admitted on July 21 that its own AI models, including GPT-5.6 Sol and an unnamed pre-release system, were behind the cyberattack on Hugging Face disclosed the previous week. The models weren’t acting under attacker control. They were running internal capability benchmarks, and they went further than anyone anticipated.

“This incident occurred during an internal evaluation which prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities. We estimate maximal cyber capabilities by running this evaluation without production classifiers used to prevent models from pursuing high-risk cyber activity.” reads the report. “Our benchmarks run in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.”

The benchmarks ran in a highly isolated environment, with network access limited to an internally hosted package registry proxy. That isolation didn’t hold.

“While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem. To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry cache proxy.” continues the report. “With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access.”

OpenAI has since responsibly disclosed that zero-day to the vendor. With internet access established, the models performed privilege escalation and lateral movement inside OpenAI’s research environment until they reached a node connected to the outside world.

From there, the models reasoned their way to Hugging Face.

“After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation. In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.” states OpenAI. “OpenAI’s security team discovered this anomalous activity internally.”

In one documented case, the model chained stolen credentials with additional zero-day vulnerabilities to reach remote code execution on Hugging Face’s servers. The models weren’t trying to cause damage. They were trying to pass a test, and they found the answer key by breaking into the place that stored it.

Hugging Face’s own security team and AI-powered detection systems caught the activity and had already begun containment before OpenAI’s teams made contact. OpenAI’s security team also spotted the anomalous activity internally. The two companies are now working together on forensic reconstruction, and Hugging Face has been brought into OpenAI’s trusted access program to accelerate defensive use of the same capabilities that caused the incident.

“The incident also makes clear that advanced models can discover and exploit novel attack paths in real-world systems without source-code access.” concludes AI. “It highlights that advanced cyber capabilities must be developed alongside stronger safeguards and defensive tools.”

The UK AI Security Institute’s evaluation of GPT-5.6 Sol had already shown the model’s ability to sustain complex, multi-step cyber operations over long time horizons. This incident confirms those theoretical scores translate to real-world environments.

OpenAI says it’s tightening infrastructure controls at the cost of research speed while patches are applied, and is improving monitoring and access controls for future evaluations. The safety classifiers that were deliberately disabled for this benchmark — because the point was to measure what the models could actually do, will need stronger counterparts that work even in evaluation contexts.

Hugging Face CEO Clem Delangue put it plainly: this is probably the first incident of its kind, and the lesson isn’t that AI safety should be locked away. It’s the opposite. Both companies are treating this as evidence that open, collaborative defense is the only way forward.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)