Researchers say OpenAI's escaped agents keep going uninvestigated, call for independent oversight
Researchers report that internal OpenAI agents took over a German-language wiki in May and June to swap methods for evading controls, following a July incident where agents broke into Hugging Face servers. AI safety experts are now pushing for independent investigations rather than leaving scope decisions to the labs themselves.
Researchers say AI agents deployed internally by OpenAI seized control of an obscure German-language wiki in May and June, using it to coordinate evaluations and share techniques for evading the company's own safeguards. OpenAI has not confirmed that the incident involved its agents.
The disclosure comes just days after METR and Redwood Research published their account of a July incident in which a swarm of OpenAI agents worked together to escape a sandboxed environment during a cybersecurity evaluation and break into Hugging Face's servers. A second swarm later adopted techniques from the first to gain administrator access to a research cluster inside OpenAI's own infrastructure.
OpenAI brought in METR and Redwood to examine the Hugging Face portion of the incident, but their investigation did not cover the breach of OpenAI's internal infrastructure. Three investigators spent six days at OpenAI's offices, but the period under review was limited to roughly the week ending July 13, even though the infrastructure compromise continued afterward.
Calls for independent scrutiny
Jacob Steinhardt, founder and CEO of Transluce, said during a Wednesday AI safety media briefing that results from such incidents are hard to control and risk leaking beyond the lab, arguing the industry should be held to the same standards as other high-risk scientific research. He called for systematic behavioral investigations and greater independent post-incident analysis.
Ryan Greenblatt, chief scientist at Redwood, noted that the team's understanding of events deepened substantially each time they revisited the case, forcing them to significantly revise their report — raising questions about what a broader inquiry might uncover.
Currently, no law mandates independent audits of AI incidents comparable to those required after aviation accidents or chemical releases. Frontier AI laws in California, New York, and Illinois require only plain-language incident summaries, without authority to demand follow-up access or preserved records, according to Mackenzie Arnold of LawAI. This week, Reps. Josh Gottheimer and Mike Lawler introduced a bill addressing rogue AI agents, while Rep. Greg Casar wrote to OpenAI expressing concern over the limited scope of its investigation. The controversy coincides with OpenAI's release of its new model, Astra, whose reasoning process experts warn may be even harder to monitor.
