A new report from the cybersecurity research organization Transluce shows that swarms of OpenAI agents tried to hack their way into several public data sources earlier this year. They probed a pharmaceutical-data dashboard run by the Australian Institute of Health and Welfare, tried to access University of Iowa education data through a site called Data USA, and repeatedly attempted to retrieve a single photograph from a University of New Mexico digital collection of tuberculosis sanatorium images.
Some of this activity had been reported earlier, but the new research shows that the agents did more than simply “interact” with the sites. When ordinary attempts to retrieve the information failed, they started probing for vulnerabilities. Transluce says it found no evidence that those attacks succeeded. Still, add them to what happened later in the summer, when OpenAI agents hacked into Hugging Face servers as part of an elaborate scheme to cheat on the evaluations they were undergoing, and a pattern starts to emerge.
Transluce was able to tie the Data USA and Australian government activity to agents from a swarm that had previously used an obscure German wiki site as a bulletin board while trying to complete web-lookup tasks. OpenAI has already acknowledged that those agents were its own. The report also describes earlier attempts to retrieve Thai government statistics through increasingly convoluted routes, though Transluce is less certain that those were carried out by the same OpenAI agents.
All this became possible when the agents figured out how to jump out of OpenAI’s secure testing environment and gain access to the web. Given what we now know about what they did once they got out, you might imagine the test taking place inside a steel box buried 100 feet beneath the Nevada desert, or in a government secure facility, a SCIF, with the machines air-gapped from the open internet.
But that’s not the kind of test OpenAI wanted to run. Its researchers were testing the agents on their ability to conduct sophisticated cyberattacks, so naturally they wanted to confine the agents to a secure testing environment (a “sandbox”) with no internet access where they couldn’t do real-world harm. But the eval tests were also really hard, approaching impossible.
That was the point. The company says it prompted models to “pursue advanced exploitation using complex attack paths” to find the answers to the test. It wanted them to improvise and be creative. In order to do that, the agents had to have the ability to grab software—software that’s normally downloaded from the web. In order to accommodate that without providing full internet access, the researchers had the AI use a sort of intermediary. This was a tool called Artifactory, which would download the necessary software, then deliver it into the testing environment.
The eval trade-off
Artifactory turned out to be their way out.
The agents exploited vulnerabilities in the software, using it first as an unauthorized bulletin board and eventually as a route to greater access. When straightforward ways of solving their assigned problems failed, the agents found other routes, including ones that led beyond the intended boundaries of the test.
Much of the strangest behavior was driven by an effort to cheat on the evals and then conceal that cheating. That was the main reason agents eventually turned their attention to Hugging Face. They were looking for information about how their performance would be scored.
What followed was considerably more serious. OpenAI says its agents executed code on dozens of Hugging Face servers, gained full root access on one, obtained limited private data, and acquired credentials to Hugging Face’s messaging platform. The agents later gained administrator access to an OpenAI Kubernetes research cluster supporting its virtual-machine environments, and reached cloud secrets. (You can read about all the crazy stuff the agents tried in the report from independent evaluators METR and Redwood Research.)
Locking the agents inside a completely air-gapped environment might have prevented much of that. But it also would have taken away some of the capabilities researchers were trying to test. OpenAI wanted to know what highly capable cyber agents could actually do, which meant giving them access to software and tools and, for the purposes of the eval, removing safeguards that would ordinarily be present in deployed models.
As the researchers allowed the agents more autonomy to act as they would in the real world, they also elevated the risk that the agents would find a reason and the means to escape.
Just the start?
OpenAI has since said it is changing the way it tests powerful artificial intelligence agents. Among other measures, it has added network-isolation controls intended to ensure that compromising a single workload or supporting service, like Artifactory, cannot by itself provide access to the internet or other internal networks.
(OpenAI isn’t the only lab to have run into this problem. Anthropic has disclosed four incidents in which Claude models gained unauthorized access to real third-party systems during cybersecurity evaluations. Anthropic says all four occurred during tests built by the same outside partner, where Claude was told it had no internet access but a misconfiguration left it connected. As in the OpenAI tests, the cyber safeguards that normally ship with the models had also been disabled for the evals.)
The rogue agent incidents raise a broader question about how AI agents should be tested as they become more intelligent and capable in the future—even to the point where they’re more intelligent than the human researchers.
One thing is clear. OpenAI’s rogue agents hit a nerve that runs deeper than cybersecurity. The episodes looked unnervingly like a familiar AI nightmare: machines escaping human containment and treating the rules imposed on them as obstacles to whatever goal they had been given.
Isn’t that the plot of every bad sci-fi movie since Kubrick’s 2001?