OpenAI models accessed the public internet during separate third-party cyber evaluations conducted by independent testing partners, prompting the company to review how high-risk AI testing is managed. OpenAI said the incidents occurred under specialized testing configurations with reduced safeguards and did not reflect how its models operate in public deployments. The company added that the events were unrelated to the previously disclosed Hugging Face security incident.

The incidents involved evaluations conducted by UK AISI and cybersecurity testing partner Irregular, where testing conditions or environment configurations enabled models to interact with systems beyond the intended evaluation boundaries.

OpenAI Models Prompt Review of Third-Party AI Testing

OpenAI said independent cybersecurity evaluations are essential for understanding model capabilities before deployment. Some evaluations intentionally reduce safeguards or enable additional capabilities to measure how models perform under conditions that resemble real-world cyber operations.

According to the company, the latest incidents highlighted the need to strengthen the security controls surrounding independent testing environments as AI models become more capable.

OpenAI said it will review how it manages third-party cyber evaluations, including how higher-risk testing is identified, when internet access or reduced safeguards should be permitted, how testing environments should be isolated, and how incident reporting and monitoring procedures should be handled.

The company also plans to work with national AI institutes, independent evaluators, and other AI developers to establish stronger industry practices for high-risk AI evaluations.

UK AISI Identified Two Unsanctioned Actions by GPT 5.6 Sol

On August 3, UK AISI, the UK's AI Security Institute, informed OpenAI that during a cyber evaluation that began on July 25, models from OpenAI and another AI lab performed activities beyond the intended testing scope.

The evaluation used simulated cyber ranges where models acted as cybersecurity experts in a Capture-the-Flag exercise. Internet access was intentionally enabled so agents could download tools similar to those available to real attackers, while cyber classifiers were disabled to measure underlying model capability.

Among 19 recorded events, two involved GPT 5.6 Sol.

According to OpenAI, the model reused a publicly accessible GitHub token left behind by another lab's agent to determine whether systems inside the simulated environment were communicating with GitHub or update services. It also attempted account recovery and request-limit workarounds while registering accounts with external DNS and tunneling providers.

In a separate action, GPT 5.6 Sol used a public tunneling service to expose a locally hosted DNS server from the evaluation environment to the public internet. The server contained exploit payloads intended for a known software vulnerability within the simulated cyber range.

OpenAI said the setup did not function as intended, no evidence indicated that any real internet resolver queried the server, and the infrastructure was removed when the evaluation concluded.

UK AISI considered both actions outside the authorized testing boundary because they involved external services that were not required to complete the exercise.

Security monitoring detected unusual data transfers on July 28. UK AISI halted the evaluation, isolated the affected systems, and contained the activity within approximately one hour.

Irregular Finds Misconfigured Testing Environment

A second incident was reported on July 29 by Irregular, another organization conducting third-party cyber evaluations for OpenAI.

The testing environment was intended to remain isolated from the internet during another Capture-the-Flag exercise. However, a configuration error unintentionally allowed the models to access external websites.

During one evaluation, the fictional domain used in the exercise matched an actual website. Because internet connectivity was available, the model interacted with the live site, believing it was part of the simulated challenge.

Irregular said the incident did not involve a sandbox escape or zero-day exploit. Instead, the model exploited a basic security vulnerability on the website after gaining unintended internet access.

The investigation also found that the model used credentials associated with the same website. According to Irregular, no impacts beyond that site's own data have been identified, although its audit remains ongoing.

The organization has paused the evaluations, completed remediation, notified affected third parties, and implemented additional safeguards in its testing environment.

OpenAI said it will continue working with both UK AISI and Irregular to improve evaluation practices while ensuring independent cybersecurity testing remains rigorous as AI capabilities continue to advance.

Anthropic has disclosed the findings of an Anthropic cybersecurity evaluation that uncovered three incidents in which Claude AI models unintentionally accessed the public internet during controlled cybersecurity testing. The company said the events stemmed from misconfigured third-party evaluation environments rather than deliberate attempts by the models to escape their testing boundaries. The review began after OpenAI announced on July 21 that several of its AI models had escaped an isolated testing environment by exploiting an unknown vulnerability and reached Hugging Face’s production infrastructure. In response, Anthropic examined 141,006 cybersecurity evaluation runs, identifying three confirmed incidents across six runs, including four involving the same organization.

Anthropic Cybersecurity Evaluation Traced Issue to Testing Environment

All three incidents occurred during capture-the-flag (CTF) cybersecurity exercises, where Claude AI models were instructed to retrieve a hidden "flag" from what they were told was a fully isolated network with no internet access. However, a configuration error between Anthropic and evaluation partner Irregular unintentionally allowed internet connectivity. Because the models believed every reachable system belonged to the simulation, they treated real production infrastructure as legitimate CTF targets. Anthropic said the models relied on basic attack methods, including exploiting weak passwords, exposed debug pages, unauthenticated services and SQL injection, rather than sophisticated exploits or attempts to escape the environment. The incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model. The earliest occurred in April 2026. Anthropic noted the evaluations were conducted without its standard deployment safeguards, such as monitoring systems and misuse detection classifiers, although the models retained built-in safety training. The evaluation infrastructure also remained isolated from Anthropic's internal systems and customer data.

Three Incidents Involving Claude AI Models 

The first incident, involving Claude Opus 4.7, occurred after a fictional company used in the evaluation shared its name with a real website domain. Across four evaluation runs, the model failed to locate its simulated target, discovered the real company online, and compromised its infrastructure. It extracted application and infrastructure credentials and accessed a production database containing several hundred rows of data. Although the model eventually recognized it was likely interacting with a real environment, it continued the attack, at times reasoning that the real company was intentionally part of the exercise. The second incident involved Claude Mythos 5. During the exercise, the model encountered fictional setup instructions referencing a nonexistent Python package on PyPI. Believing it was solving the challenge, Claude created an account, published a malicious package, and spent considerable effort overcoming obstacles, including finding an email provider after unsuccessfully attempting to obtain a phone number for registration. The package remained publicly available for about one hour before PyPI removed it. During that time, it was downloaded and executed on 15 real systems, including a security company's automated malware scanner. Anthropic said the scanner executed the hidden code, allowing credentials to be exfiltrated and later used to access additional infrastructure. Claude itself acknowledged early in the evaluation that publishing the package on the real internet would be "NOT okay, and surely not the intended solution," but ultimately convinced itself it was still operating in a simulation. The third incident involved an internal research model that scanned roughly 9,000 internet-connected targets after failing to reach its fictional objective. It eventually compromised one organization's internet-facing application using exposed credentials and SQL injection. Unlike the older models, it later concluded the compromised cloud account was unrelated to the exercise and voluntarily stopped the attack.

Anthropic outlines Lessons from Cybersecurity Evaluation 

Anthropic began reviewing transcripts on July 23, suspended all cybersecurity evaluations after detecting possible internet access, and confirmed the three incidents by July 24. On July 27, it informed Irregular and the affected organizations. Two organizations had not previously detected the activity and are working with Anthropic on remediation, while efforts to contact the third continue. The Anthropic cybersecurity evaluation concluded that the incidents reflected operational and evaluation-environment failures rather than model alignment failures. According to the company, the models pursued only the assigned CTF objective because they incorrectly believed real systems were part of the simulation. Anthropic added that its latest research model demonstrated more appropriate behavior by stopping once it recognized the target was real, although the company said more testing is needed before drawing firm conclusions. Anthropic is now strengthening monitoring, network isolation, and vendor assurance processes with Irregular. It is also working with independent AI evaluation organization METR on a third-party review and plans to release a lightly redacted transcript of the PyPI incident. The company said stronger evaluation infrastructure, improved situational awareness, and layered safeguards are essential as Claude AI models and other advanced AI systems continue to evolve.

OpenAI introduced two new protections designed to help users and organizations mitigate prompt injection attacks when it launched Lockdown Mode in February. Last week, the LLM giant announced rollout of Lockdown Mode to all personal ChatGPT accounts, including Free, Go, Plus, and Pro, and also self-serve ChatGPT Business accounts. Users can enable it from ChatGPT Settings under Security.

The rollout is notable not just for what Lockdown Mode does, but for what its existence concedes.

Does the existence of Lockdown Mode imply that ChatGPT, in its default settings, does not provide robust protection against sufficiently determined data exfiltration attacks. OpenAI does not seem to dispute this. Lockdown Mode is designed to help prevent the final stage of data exfiltration from a prompt injection attack by limiting outbound network requests that could transfer sensitive data to an attacker. Lockdown Mode does not prevent prompt injections from appearing in the content ChatGPT processes.

That distinction matters enormously. Lockdown Mode is not an anti-injection control. It is a last-line-of-defense control. OpenAI is not stopping malicious instructions from reaching the model — it is blocking the network paths those instructions might use to smuggle data out. The attack still happens; the payload just has nowhere to go.

Also read: OpenAI’s New Enterprise Security Mode Locks Down ChatGPT Against Prompt Injection

What Prompt Injection Actually Is

Prompt injection is the attack class Lockdown Mode is designed to constrain. In these attacks, a third party attempts to mislead a conversational AI system into following malicious instructions or revealing sensitive information.

In a connected AI system — one that browses the web, processes documents, or interacts with external tools — the attack surface is every piece of external content the model touches. A malicious instruction embedded in a webpage, a PDF, a calendar invite, or a shared document can hijack the model's behavior without the user ever knowing it happened. The model reads the injected instruction, treats it as a legitimate command, and acts accordingly — potentially exfiltrating whatever is in the conversation window to an attacker-controlled endpoint via a web request.

As AI systems become more capable and connected, this threat class has moved from academic demonstration to production risk. Agent Mode, Deep Research, live web browsing, and file connectors all dramatically expand the surface area available for injection attacks — and all of them represent outbound network paths a compromised model could abuse.

What Lockdown Mode Disables and Why

When enabled, the Lockdown Mode limits or turns off certain features that connect ChatGPT to the web or external services, including live web access, image support in responses, Deep Research including shopping research, Agent Mode, Canvas networking, live connectors and file downloads.

Each disabled feature maps directly to an exploitation pathway. Live web access allows the model to retrieve attacker-controlled content. Agent Mode allows autonomous multi-step actions, meaning an injected instruction has more time and capability to execute before a human notices. File downloads create an outbound data transfer channel. Image support in responses can encode and transmit data through image URLs. Disabling all of them simultaneously removes the most exploitable exfiltration paths without modifying the model itself.

The tradeoff is real. Lockdown Mode disables several important features, including Deep Research and live web access. If you rely on up-to-date information, advanced workflows, or multi-step research tools, enabling it may limit your productivity in certain parameters. OpenAI is explicit that this is a deliberate trade — capability for security surface reduction — and that it is designed for people and organizations that handle sensitive data and want stricter protection from data exfiltration risks related to prompt injection.

Lockdown Mode is for Whom?

Lockdown Mode is aimed at people facing elevated digital risk, including journalists, activists, and users working in sensitive environments. To that population, add legal, financial, and healthcare professionals who paste client or patient documents into ChatGPT; executives whose conversations contain strategic or deal-sensitive information; security analysts who process threat intelligence in AI workflows; and any organization operating under data residency or confidentiality obligations that prohibit third-party data transmission.

For folks who have an elevated risk profile due to who they are, what they work on, or the types of data they work with, it's an excellent tool for further securing themselves. This has some tradeoffs on functionality and utility, but for these users, the tradeoff is worthwhile.

For everyone else, as AI systems take on more complex tasks — especially those that involve the web and connected apps — the security stakes change. Lockdown Mode going to all personal accounts is the right moment for every user who regularly pastes sensitive material into ChatGPT to make an explicit, informed decision about whether the productivity features they are trading away are worth more than the exfiltration risk they are trading for.

Lockdown Mode is available now across all ChatGPT account types. It can be enabled from Settings → Safety and security → Advanced security → Lockdown Mode toggle, with a per-session override in the header for moments when a connected feature is needed for a lower-risk task.

OpenAI has officially entered the AI cybersecurity race with the launch of OpenAI Daybreak, a new initiative focused on helping security teams identify, validate, and fix software vulnerabilities faster using artificial intelligence. Announced through the company’s LinkedIn post, OpenAI described Daybreak as its vision for “a new era of cyber defense,” where AI systems can assist defenders across secure code reviews, vulnerability analysis, remediation, and threat investigation workflows. The launch reflects a growing industry trend in which AI companies are positioning advanced language models as cybersecurity tools capable of reducing the time between vulnerability discovery and remediation. While AI-generated coding tools have often raised concerns around insecure code generation, companies are now increasingly focusing on using AI defensively to strengthen software security practices. According to OpenAI, AI models are already changing how security teams operate by enabling them to reason across large codebases, identify subtle vulnerabilities, validate fixes, and analyze unfamiliar systems more efficiently. However, the company also acknowledged that advanced AI cybersecurity capabilities require “trust, verification, safeguards, and accountability,” particularly as AI systems become more capable of handling sensitive defensive workflows.

What Is OpenAI Daybreak?

At the center of the announcement is OpenAI Daybreak, a cybersecurity-focused platform powered by GPT-5.5 and Codex, OpenAI’s coding-focused agentic system. OpenAI said the platform is designed to help organizations move from vulnerability discovery to remediation faster while improving visibility into the entire security workflow. The system combines AI reasoning with coding automation to support several defensive security functions, including:

• Secure code reviews
• Threat modeling
• Patch validation
• Malware analysis
• Dependency risk analysis
• Remediation guidance
• Vulnerability triage
• Detection engineering

One of the more notable capabilities highlighted by OpenAI is the platform’s ability to generate and test patches directly within repositories. According to the company, these workflows operate under monitored and controlled access models while also producing audit-ready reports that help security teams verify remediation activity. The emphasis on auditability suggests OpenAI is attempting to address one of the biggest concerns surrounding AI in cybersecurity: the need for accountability and human oversight in automated decision-making.

OpenAI Introduces Tiered Cybersecurity Access

OpenAI is rolling out Daybreak through three different access levels depending on the sensitivity and complexity of cybersecurity operations. The first layer uses GPT-5.5 for broader security assistance and general workflows. The second tier, GPT-5.5 with Trusted Access for Cyber, is aimed at defensive cybersecurity tasks such as secure code review, malware analysis, vulnerability triage, detection engineering, and patch validation. The highest tier is powered by GPT-5.5-Cyber, which OpenAI says is intended for specialised and authorised workflows including penetration testing, red teaming, and controlled validation exercises. The structured access model indicates OpenAI is taking a cautious approach toward releasing advanced cyber capabilities, especially as concerns grow around dual-use AI systems that can potentially be misused by threat actors.

AI Cybersecurity Competition Continues to Grow

The launch of OpenAI Daybreak also comes at a time when AI companies are increasingly competing to establish themselves in cybersecurity operations. Recently, Anthropic introduced Claude Mythos, a cybersecurity-focused AI system that the company claimed could identify software vulnerabilities at a scale beyond what human experts can typically achieve. However, Anthropic stated that Claude Mythos would not be released publicly due to risks associated with its advanced cyber capabilities. That contrast highlights a broader debate currently shaping the AI cybersecurity sector. While companies see AI as a major force multiplier for defenders, there are ongoing concerns about how powerful cyber-focused AI models should be deployed, monitored, and restricted. For OpenAI, Daybreak appears to position the company toward enterprise-controlled and monitored security environments rather than open public access.

AI’s Role in Cyber Defense Is Expanding

The launch of OpenAI Daybreak reflects how rapidly AI is becoming embedded into cybersecurity workflows. Security teams are increasingly under pressure to manage growing attack surfaces, software complexity, and faster-moving threats, making automation and AI-assisted analysis more attractive. At the same time, the rollout of advanced cyber-focused AI systems is likely to intensify discussions around governance, oversight, and responsible deployment. With companies like OpenAI and Anthropic now building specialised cybersecurity AI platforms, the next phase of cyber defense may increasingly depend on how effectively organizations balance AI-driven speed with security safeguards and human verification.

The fallout from the Axios npm supply chain attack continues to widen, with OpenAI issuing a detailed response outlining its exposure and remediation steps. The Axios npm supply chain attack, reported by The Cyber Express on April 1, has since been linked to North Korea’s Lazarus Group, significantly expanding the scope and impact of the incident. Attribution was confirmed by Google Threat Intelligence Group, which identified the activity under UNC1069, a financially motivated group active since at least 2018.

OpenAI Confirms Limited Exposure to Axios npm Supply Chain Attack

In its official statement, OpenAI said, “We recently identified a security issue involving a third-party developer tool, Axios, that was part of a widely reported, broader industry incident⁠.” The company clarified that while it was affected by the broader Axios npm supply chain attack, there is no evidence of compromise to user data or internal systems. “We found no evidence that OpenAI user data was accessed, that our systems or intellectual property was compromised, or that our software was altered,” the statement added. The exposure occurred on March 31, 2026, when a GitHub Actions workflow used in OpenAI’s macOS app-signing process executed a malicious version of Axios (v1.14.1). This workflow had access to sensitive code-signing certificates used for validating OpenAI applications like ChatGPT Desktop, Codex, Codex CLI, and Atlas.

Certificate Rotation and macOS App Updates

As a direct response to the Axios npm supply chain attack, OpenAI has initiated a full rotation of its macOS code-signing certificates. While internal analysis suggests the certificate was likely not exfiltrated, the company is treating it as potentially compromised. To mitigate any residual risk, OpenAI is requiring users to update their macOS applications. Older versions of affected apps will lose support and functionality after May 8, 2026. Updated versions will carry new certificates to ensure authenticity. This move is designed to prevent threat actors from distributing malicious software disguised as legitimate OpenAI applications, a known risk in supply chain attacks involving code-signing materials.

Investigation and Security Measures

OpenAI engaged a third-party digital forensics and incident response firm to investigate the impact of the Axios npm supply chain attack. The company also coordinated with Apple to block any new notarization attempts using the old certificate. Additional steps taken include:

• Publishing new builds of all affected macOS applications
• Reviewing all past software notarizations for anomalies
• Ensuring no unauthorized modifications were made to distributed software

The company confirmed that no malicious applications signed with its certificate have been identified so far.

Root Cause: GitHub Workflow Misconfiguration

The root cause of OpenAI’s exposure to the Axios npm supply chain attack was traced to a misconfiguration in its GitHub Actions workflow. Specifically, the workflow relied on a floating tag instead of a fixed commit hash and lacked a minimum release age for dependencies, both of which increased the risk of pulling compromised packages. This highlights a broader industry issue where development pipelines remain vulnerable to upstream compromises, especially in open-source ecosystems.

No Impact on User Data or Other Platforms

OpenAI emphasized that the incident is limited strictly to macOS applications. There is no impact on iOS, Android, Windows, Linux, or web-based services. The company also reassured users:

• No user data or API keys were compromised
• No passwords need to be changed
• No malware signed as OpenAI has been detected

What Happens Next

OpenAI will fully revoke the old certificate on May 8, 2026, after a 30-day transition window. This approach is intended to minimize disruption while ensuring users have adequate time to update their applications. The company noted that any software signed with the old certificate will be blocked by macOS security protections after revocation, further reducing the risk of misuse.

Growing Impact of Axios npm Supply Chain Attack

The Axios npm supply chain attack highlight the escalating risks tied to third-party software dependencies. With attribution pointing to a state-sponsored group, the incident reflects how supply chain attacks are increasingly being leveraged for financial and strategic objectives. As organizations continue to rely heavily on open-source libraries, the incident serves as a reminder of the need for stricter dependency management, secure development practices, and continuous monitoring of software pipelines.