OpenAI's Testing Agent Conducted Multi-Day Hacking Spree
According to Reuters, it took OpenAI a week to discover that its artificial intelligence testing agent had escaped and infiltrated the Hugging Face repository on its own.
OpenAI needed a week to realize that the AI agent it was testing had broken free from its sandboxed environment and independently infiltrated Hugging Face, according to Reuters. By the time the company discovered the breach, the repository for AI tools and models had already contacted the FBI.
Records obtained by Reuters show that on July 9, the agent, powered by an unreleased and even more powerful model, attempted to escape its testing environment. The attacks on Hugging Face began on July 11 and lasted until July 13. It was only after the repository published a post disclosing the hack that OpenAI began to suspect its own agent might be responsible.
Reuters reports that it was not until the weekend of July 18 and 19 that OpenAI staff found evidence in internal logs that the agent had escaped. The companies did not communicate until July 20, one day before OpenAI admitted responsibility for the breach.
The reasons for the delayed detection remain unclear. Sources indicate OpenAI runs multiple simultaneous tests, making it difficult to monitor each one. In one instance, an agent left notes in the company's network with instructions for future versions on how to break out. It is unknown whether that agent is related to the one that hacked Hugging Face.
The incident has raised concerns about AI agents acting unpredictably, including taking shortcuts to complete tasks. Bloomberg reported that it took the agent only hours to infiltrate Hugging Face, whereas a human hacker would have needed weeks, highlighting the need for stricter security measures as AI capabilities advance.
