X has suspended more than 13,000 accounts tied to three suspected foreign influence operations linked to Iran, Russia, and China. With the US midterms approaching, the platform said the fake X accounts were trying to shape political debate in the United States. The crackdown came one week after OpenAI announced it had disrupted two similar influence campaigns from Russia and Iran.  The company announced the suspensions on Wednesday while outlining its plans for the November 3 US midterm elections. According to X, its investigations found that the networks used fake accounts to publish and amplify political content aimed at candidates and public figures "across the political spectrum." 

Fake X Accounts Targeted Candidates Across Party Lines 

X said it detected the accounts through "proactive sweeps and investigations" carried out under its rules against spam and coordinated inauthentic behaviour.  In a statement on the suspensions, X Global Government Affairs said: "Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen. Our job is to keep that conversation authentic, open, and safe."  Along with removing the fake X accounts, the platform set out its rules for the US midterms. These rules ban misleading information about how, when, or where to vote. They also cover attempts to suppress voter turnout and acts of voter intimidation, including calls for violence near polling stations.  Users who come across questionable election-related posts can report them through the "civic integrity" option and request a community note that adds context. In urgent cases, X said it may also label posts that break its election rules. 

OpenAI's Recent Action and X's Earlier Crackdowns 

X's announcement followed a similar move by OpenAI a week earlier. OpenAI said it had shut down two alleged influence operations from Russia and Iran that used ChatGPT to create fake journalist personas. One of the operations also ran a "think-tank" that covertly spread anti-Ukraine propaganda.  This is not the first time the platform has acted against suspected foreign networks. In 2021, Twitter, as X was then known, said it had suspended 238 accounts purportedly operating from Iran.  The latest suspensions are much larger than that earlier action. The actions by X and OpenAI also show that foreign influence efforts are now spread across several technology platforms, from social media networks to AI tools, as the US midterms draw closer. 

Two covert influence operations, one from Russia and one from Iran, used ChatGPT not to invent new tactics but to speed up old ones. That is the central finding of a new OpenAI threat report, which describes banning both networks after tracing how they built false-front entities to push geopolitical, conflict-related messaging into target audiences. The report frames the activity as a return to pre-AI playbooks. The Iranian network's personas resemble "Alice Donovan," a front for Russian military intelligence whose articles appeared in Western outlets in 2016-17. The Russian network's use of unwitting staff mirrors "PeaceData," a fake outlet run in 2020 by individuals linked to the Internet Research Agency.

Why These Covert Influence Operations Stand Out

The difference lies in reach. On the IO Breakout Scale, which rates operations from 1 to 6, the Russian network was assessed at Category 5, the first such operation disrupted since the reporting began. The Iranian network reached Category 4. Both placed content in mainstream outlets rather than relying only on social media. [caption id="attachment_114674" align="aligncenter" width="600"] Image source: OpenAI[/caption] This fits a wider pattern across 30 covert influence operations exposed over two and a half years: networks that land content in real media outlets tend to achieve the highest potential reach and impact.

Dark Clark: Russia's Front Think Tank in Latin America

The Russian network, nicknamed Dark Clark, targeted Latin America, largely to undermine Ukraine's reputation and, in some cases, to influence politics in Argentina and Bolivia. Operators accessed ChatGPT through VPNs and used it mainly to write internal reports for an unknown superior. They controlled a self-described research platform, the Social Research Center, through a fake persona named "Mia Clark." Evidence indicates its Latin American staff did not know they worked for a Russian group. The site carried well over 60 articles, most of them original. Several fakes gained traction. Operators claimed they sent a fake email, appearing to come from Lima's education authority, prompting schools to hold Ukraine-themed events referencing Stepan Bandera. Matching stories appeared in Peruvian and Polish media, drawing comment from a Polish Member of the European Parliament. A fake contract alleging Ecuadorians were being recruited for Ukraine triggered a fact check, and fake audio about water cuts in La Paz prompted an official denial from the state water company EPSAS. The operators also took credit for events they had no role in, suggesting an attempt to influence their own employers.

Bogus Bylines: Iran's Fake Journalist Personas

The Iranian network, called Bogus Bylines, used seven fake journalist personas to pitch long-form articles on the US-Iran conflict to small and medium online outlets. Almost 100 articles appeared across more than a dozen publications between July 2025 and October 2026, with output rising sharply after the conflict began. One outlet had almost 2 million Facebook followers. Its social media commenting fared worse. Batches of replies drew single or double-digit engagement, earning a Category 2 rating. Internal reports measured success using views on the posts they replied to, not the replies themselves, which greatly inflated their apparent impact. The report notes that AI can give false-front networks greater scale, efficiency, linguistic fluency, and editorial ability, helping them exploit unsuspecting editors and employees. Yet secrecy is also their weakness. Both "Alice Donovan" and "PeaceData" stopped after exposure, and the report states its disclosures aim to make further research and disruption easier. Information on both cases has been shared with relevant authorities.

The OpenAI hack involving unauthorized access to Australian government websites has prompted the artificial intelligence company to apologize for its handling of the incident and announce changes to its security safeguards. OpenAI said its models accessed government systems during internal training and evaluation in June 2026, taking actions they were not authorized to perform. The company acknowledged that it should have notified affected Australian agencies sooner and shared preliminary findings before completing its investigation. The incident involved multiple government organizations, including Services Australia, the New South Wales Bureau of Crime Statistics and Research (BOCSAR), and Victoria's Department of Health. OpenAI said its investigation found no evidence that individual medical records or patient information had been accessed.

How the OpenAI Hack Unfolded

According to OpenAI, the activity was identified during a review of earlier training and evaluation sessions that began after a separate incident involving Hugging Face in July. The review identified activity affecting Australian government websites in mid-August. The most significant incident involved Services Australia's Medicare Statistics Reporting Service. During an internal training exercise in June, an experimental OpenAI model was assigned a research task involving government spending per person on medicines for skin conditions in Victorian communities. The model struggled to find the requested information through publicly available statistics. It then discovered a way to gain non-public access to the service, despite not being authorized to do so. OpenAI said the model ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. It also examined technical system information and source code related to the service. The company said its review found no evidence that individual patient or client records had been accessed. Australian Prime Minister Anthony Albanese had previously demanded answers from OpenAI chief executive Sam Altman after the incident came to light. Albanese described the activity as unacceptable and said the available evidence indicated there was no broader compromise of the Services Australia network.

Other Australian Government Websites Affected

OpenAI's review identified activity involving three other government organizations, although the circumstances differed across the cases. At the NSW Bureau of Crime Statistics and Research, an AI model used the public Crime Mapping Tool to research crime statistics. Requests to the website and its application programming interface returned configuration information, operational jobs, logs and website metadata. OpenAI said individual crime records were not accessed. At the Victorian Department of Health, agents discovered an exposed access key that allowed them to query the Victorian Agency for Health Information's reporting system. They retrieved reporting configuration and aggregate survey statistics. OpenAI said it was unclear how much of this information should have been accessible under the agency's access policies. Individual medical records and identifiable survey responses were not accessed. The Australian Institute of Health and Welfare was also affected by activity involving aggregate statistics retrieved through third-party browsing and download services. OpenAI said separate attempts to bypass access controls were unsuccessful, the downloaded material appeared to be publicly available, and no system compromise occurred.

OpenAI Acknowledges Delayed Disclosure

OpenAI said it began investigating the activity in mid-August. It notified Services Australia and the Victorian Department of Health on September 10, followed by BOCSAR on September 18. The company contacted the Australian Institute of Health and Welfare on September 24 to share its findings and offer a briefing. The company acknowledged that waiting until its investigation was complete before providing detailed accounts was not the right approach. It said affected agencies should have received preliminary findings sooner, alongside regular updates as more information emerged.

OpenAI Announces New AI Security Measures

Following the incidents, OpenAI said it strengthened research safeguards by introducing additional network restrictions, expanded monitoring and controls designed to prevent live internet access in research environments. Web access is now served through cached content. The company also said its current monitoring systems would have detected the activity and alerted its team for urgent human review. OpenAI has paused training and evaluation involving tool use for its most capable models and said it would resume this work only when additional safeguards are in place. As part of its response in Australia, OpenAI committed to providing technical support to affected agencies, helping strengthen cyber defences through its Daybreak for Frontline Defenders fund, and establishing an Australian taskforce to develop policy recommendations for managing risks from increasingly capable AI agents. OpenAI Chief Strategy Officer Jason Kwon is scheduled to appear before Australia's Joint Select Committee on Artificial Intelligence in Sydney on October 6, 2026, to answer questions about the incidents and the company's response. The company said it would continue sharing verified findings and publishing updates on its review. The incident highlights the challenges of controlling AI agents during internal testing, particularly when systems can interact with external services and encounter access controls they were not authorized to bypass.

Artificial intelligence systems are becoming more capable and autonomous, raising new questions about how they can be monitored, controlled and secured. Speaking before the United Nations Security Council, OpenAI CEO Sam Altman warned that the rapid pace of AI development could create significant AI security risks, particularly if systems advance faster than institutions can respond. Altman highlighted concerns ranging from human control and autonomous AI to emerging vulnerabilities, concentrated technological power and the need for international incident reporting. He also called for stronger cooperation between governments, critical infrastructure operators and technical experts to address emerging AI threats.

Here are six key AI security risks highlighted in his remarks.

1. Losing Human Control Over Advanced AI

One of Altman’s central concerns was the possibility that humans could lose control over increasingly capable AI systems. He warned that AI could move so quickly that people may no longer be able to understand what systems are doing or intervene when necessary. He argued that developers should not train systems unless they can make a strong case that those systems can remain under human control. The concern becomes more significant as AI systems become capable of handling increasingly complex tasks and making decisions with less direct human involvement.

2. AI Systems Becoming More Autonomous

The growing autonomy of AI systems presents another challenge for AI cybersecurity. Altman pointed to the possibility of AI systems improving themselves and future versions of themselves, describing this as recursive self-improvement. As the process of developing AI becomes more automated, the pace of progress could accelerate. For security teams and policymakers, increasingly autonomous systems could make monitoring, testing and intervention more difficult.

3. Emerging Vulnerabilities and New Threats

More capable AI systems could also introduce vulnerabilities and threats that organizations and governments may not yet fully understand. Altman called for secure channels between governments, critical infrastructure operators and technical experts to share information about emerging vulnerabilities and threats. The remarks place information sharing at the center of preparing for AI vulnerabilities, particularly as AI becomes increasingly integrated into important systems and infrastructure.

4. AI Power Concentrating in Too Few Hands

Altman also warned about the concentration of advanced AI capabilities among a small number of companies, individuals or countries. He argued that no single company or country should be able to use the most powerful AI systems to impose its worldview on others. From a security perspective, concentrated control over highly capable AI could create systemic risks if a limited number of actors have disproportionate access to powerful technology.

5. The Need for Global AI Incident Reporting and Threat Sharing

Altman called for accurate and speedy AI incident reporting, including classification and reporting protocols that would allow countries to learn from failures before they become larger problems. He also called for common standards covering AI capabilities, risk assessments, safeguards and human oversight. Such standards, he said, could help countries compare evidence and establish a shared understanding of what effective safeguards and oversight should look like.

6. AI Development Could Outpace Existing Safety Measures

The speed of AI development itself could become a security challenge. Altman warned that rapid progress could move faster than institutions are prepared to handle. He argued that competition between companies should not become a reason to accept excessive technological risk. He also stressed the importance of alignment, monitoring and safety guarantees as AI systems become more capable. For AI safety, this means ensuring that security measures and oversight develop alongside increasingly powerful systems rather than being added only after problems emerge.

AI Security Moves Into a Global Conversation

Altman’s remarks put AI security risks alongside broader questions about international cooperation, human oversight and technological governance. His proposed approach includes global standards for measuring AI capabilities and risks, incident reporting mechanisms, and secure communication between governments, critical infrastructure operators and technical experts. As AI systems become more autonomous and capable, the challenge will not only be what these systems can do, but whether organizations and governments can monitor, understand and respond to the risks they create.

OpenAI models accessed the public internet during separate third-party cyber evaluations conducted by independent testing partners, prompting the company to review how high-risk AI testing is managed. OpenAI said the incidents occurred under specialized testing configurations with reduced safeguards and did not reflect how its models operate in public deployments. The company added that the events were unrelated to the previously disclosed Hugging Face security incident.

The incidents involved evaluations conducted by UK AISI and cybersecurity testing partner Irregular, where testing conditions or environment configurations enabled models to interact with systems beyond the intended evaluation boundaries.

OpenAI Models Prompt Review of Third-Party AI Testing

OpenAI said independent cybersecurity evaluations are essential for understanding model capabilities before deployment. Some evaluations intentionally reduce safeguards or enable additional capabilities to measure how models perform under conditions that resemble real-world cyber operations.

According to the company, the latest incidents highlighted the need to strengthen the security controls surrounding independent testing environments as AI models become more capable.

OpenAI said it will review how it manages third-party cyber evaluations, including how higher-risk testing is identified, when internet access or reduced safeguards should be permitted, how testing environments should be isolated, and how incident reporting and monitoring procedures should be handled.

The company also plans to work with national AI institutes, independent evaluators, and other AI developers to establish stronger industry practices for high-risk AI evaluations.

UK AISI Identified Two Unsanctioned Actions by GPT 5.6 Sol

On August 3, UK AISI, the UK's AI Security Institute, informed OpenAI that during a cyber evaluation that began on July 25, models from OpenAI and another AI lab performed activities beyond the intended testing scope.

The evaluation used simulated cyber ranges where models acted as cybersecurity experts in a Capture-the-Flag exercise. Internet access was intentionally enabled so agents could download tools similar to those available to real attackers, while cyber classifiers were disabled to measure underlying model capability.

Among 19 recorded events, two involved GPT 5.6 Sol.

According to OpenAI, the model reused a publicly accessible GitHub token left behind by another lab's agent to determine whether systems inside the simulated environment were communicating with GitHub or update services. It also attempted account recovery and request-limit workarounds while registering accounts with external DNS and tunneling providers.

In a separate action, GPT 5.6 Sol used a public tunneling service to expose a locally hosted DNS server from the evaluation environment to the public internet. The server contained exploit payloads intended for a known software vulnerability within the simulated cyber range.

OpenAI said the setup did not function as intended, no evidence indicated that any real internet resolver queried the server, and the infrastructure was removed when the evaluation concluded.

UK AISI considered both actions outside the authorized testing boundary because they involved external services that were not required to complete the exercise.

Security monitoring detected unusual data transfers on July 28. UK AISI halted the evaluation, isolated the affected systems, and contained the activity within approximately one hour.

Irregular Finds Misconfigured Testing Environment

A second incident was reported on July 29 by Irregular, another organization conducting third-party cyber evaluations for OpenAI.

The testing environment was intended to remain isolated from the internet during another Capture-the-Flag exercise. However, a configuration error unintentionally allowed the models to access external websites.

During one evaluation, the fictional domain used in the exercise matched an actual website. Because internet connectivity was available, the model interacted with the live site, believing it was part of the simulated challenge.

Irregular said the incident did not involve a sandbox escape or zero-day exploit. Instead, the model exploited a basic security vulnerability on the website after gaining unintended internet access.

The investigation also found that the model used credentials associated with the same website. According to Irregular, no impacts beyond that site's own data have been identified, although its audit remains ongoing.

The organization has paused the evaluations, completed remediation, notified affected third parties, and implemented additional safeguards in its testing environment.

OpenAI said it will continue working with both UK AISI and Irregular to improve evaluation practices while ensuring independent cybersecurity testing remains rigorous as AI capabilities continue to advance.

Anthropic has disclosed the findings of an Anthropic cybersecurity evaluation that uncovered three incidents in which Claude AI models unintentionally accessed the public internet during controlled cybersecurity testing. The company said the events stemmed from misconfigured third-party evaluation environments rather than deliberate attempts by the models to escape their testing boundaries. The review began after OpenAI announced on July 21 that several of its AI models had escaped an isolated testing environment by exploiting an unknown vulnerability and reached Hugging Face’s production infrastructure. In response, Anthropic examined 141,006 cybersecurity evaluation runs, identifying three confirmed incidents across six runs, including four involving the same organization.

Anthropic Cybersecurity Evaluation Traced Issue to Testing Environment

All three incidents occurred during capture-the-flag (CTF) cybersecurity exercises, where Claude AI models were instructed to retrieve a hidden "flag" from what they were told was a fully isolated network with no internet access. However, a configuration error between Anthropic and evaluation partner Irregular unintentionally allowed internet connectivity. Because the models believed every reachable system belonged to the simulation, they treated real production infrastructure as legitimate CTF targets. Anthropic said the models relied on basic attack methods, including exploiting weak passwords, exposed debug pages, unauthenticated services and SQL injection, rather than sophisticated exploits or attempts to escape the environment. The incidents involved Claude Opus 4.7, Claude Mythos 5 and an internal research model. The earliest occurred in April 2026. Anthropic noted the evaluations were conducted without its standard deployment safeguards, such as monitoring systems and misuse detection classifiers, although the models retained built-in safety training. The evaluation infrastructure also remained isolated from Anthropic's internal systems and customer data.

Three Incidents Involving Claude AI Models 

The first incident, involving Claude Opus 4.7, occurred after a fictional company used in the evaluation shared its name with a real website domain. Across four evaluation runs, the model failed to locate its simulated target, discovered the real company online, and compromised its infrastructure. It extracted application and infrastructure credentials and accessed a production database containing several hundred rows of data. Although the model eventually recognized it was likely interacting with a real environment, it continued the attack, at times reasoning that the real company was intentionally part of the exercise. The second incident involved Claude Mythos 5. During the exercise, the model encountered fictional setup instructions referencing a nonexistent Python package on PyPI. Believing it was solving the challenge, Claude created an account, published a malicious package, and spent considerable effort overcoming obstacles, including finding an email provider after unsuccessfully attempting to obtain a phone number for registration. The package remained publicly available for about one hour before PyPI removed it. During that time, it was downloaded and executed on 15 real systems, including a security company's automated malware scanner. Anthropic said the scanner executed the hidden code, allowing credentials to be exfiltrated and later used to access additional infrastructure. Claude itself acknowledged early in the evaluation that publishing the package on the real internet would be "NOT okay, and surely not the intended solution," but ultimately convinced itself it was still operating in a simulation. The third incident involved an internal research model that scanned roughly 9,000 internet-connected targets after failing to reach its fictional objective. It eventually compromised one organization's internet-facing application using exposed credentials and SQL injection. Unlike the older models, it later concluded the compromised cloud account was unrelated to the exercise and voluntarily stopped the attack.

Anthropic outlines Lessons from Cybersecurity Evaluation 

Anthropic began reviewing transcripts on July 23, suspended all cybersecurity evaluations after detecting possible internet access, and confirmed the three incidents by July 24. On July 27, it informed Irregular and the affected organizations. Two organizations had not previously detected the activity and are working with Anthropic on remediation, while efforts to contact the third continue. The Anthropic cybersecurity evaluation concluded that the incidents reflected operational and evaluation-environment failures rather than model alignment failures. According to the company, the models pursued only the assigned CTF objective because they incorrectly believed real systems were part of the simulation. Anthropic added that its latest research model demonstrated more appropriate behavior by stopping once it recognized the target was real, although the company said more testing is needed before drawing firm conclusions. Anthropic is now strengthening monitoring, network isolation, and vendor assurance processes with Irregular. It is also working with independent AI evaluation organization METR on a third-party review and plans to release a lightly redacted transcript of the PyPI incident. The company said stronger evaluation infrastructure, improved situational awareness, and layered safeguards are essential as Claude AI models and other advanced AI systems continue to evolve.