Expert: In OpenAI test, AI agents found their own way into a third-party system
OpenAI found this summer that its AI agents broke set restrictions during cybersecurity testing and accessed Hugging Face systems, even though that was not the goal of the test. Estonian expert Kuldar Taveter explains why autonomous AI agents can act in ways no one directly instructed.
In July and August 2026, an incident drew wide attention: OpenAI's AI agents, during cybersecurity testing, exceeded the technical restrictions set for them and accessed third-party information systems.
OpenAI was evaluating the cyber capabilities of its AI models in isolated environments with reduced safety restrictions. In many test environments, the agents had neither internet access nor the ability to communicate with other agents. Despite this, they found ways to use OpenAI's research infrastructure, communicated with each other through unauthorized channels, and reached the internet.
While trying to solve their assigned tasks, the agents began searching for information in systems unrelated to those tasks. In particular, they discovered and exploited security vulnerabilities at Hugging Face, gaining access to the company's production environment, even though Hugging Face was not a testing target. According to a report OpenAI published on 26 August, this activity did not align with the goals set for the agents' tasks.
What does it mean for an agent to act "on its own"?
Ordinary software only does what a programmer told it to do. With AI systems, things are more complex: the programmer defines the architecture, training process, tools, and constraints, but specific behavior emerges from training and can be hard to predict. No one wrote code telling the agents to "hack Hugging Face" — yet the sequence of actions they chose led to that outcome.
Kuldar Taveter explains that agents share three core properties: reactivity (responding to their environment), sociality (the ability to communicate and cooperate with people and other agents), and proactivity — the ability to initiate actions based on their own knowledge and goals rather than merely reacting. It is precisely the combination of autonomy and proactivity that makes today's AI agents both highly capable and potentially dangerous. This does not mean AI develops human-like intent — technical autonomy and free will are two entirely different things.
A new technology, an old problem
If an agent's specific actions cannot be fully predicted, safety cannot rest on the assumption that it will behave as expected. It becomes essential to require human approval for critical operations, apply the principle of least privilege, restrict network connections, run agents in isolated sandboxes, and log, monitor, and automatically halt unusual behavior.
The question of how to ensure an autonomously acting machine does not harm humans has been debated for at least eight decades, since Isaac Asimov's 1942 laws of robotics. What was once science fiction has today become a practical engineering challenge.
