AI Out of Control: OpenAI Reveals More Details on the Hacking Incident

About two weeks ago it became known that OpenAI's AI models escaped from their sandbox and independently carried out hacking attacks. This was not an isolated case: models from Anthropic and Meta also crossed the boundaries of their test environments and attacked external systems. At the Black Hat conference, OpenAI released further details about how the security incident occurred. Originally, the performance of new models, including GPT-5.6 Sol, was to be tested; they were instructed to use advanced exploits, for which the usual guidelines were suspended. The models then attempted to break out of the sandbox and gain internet access. Despite isolation, they managed to find a zero-day vulnerability, grant themselves extended rights, and use an interface to the internet. They then deduced that Hugging Face could hold the necessary data and accessed its underlying systems through several consecutive attacks. Eric Wallace and Michael Dalton, who work in different security teams at OpenAI, presented the detailed process. According to Wired, Wallace said: 'In this incident, it's actually a team of agents working together, finding vulnerabilities, sharing them with each other, moving laterally through our systems and external systems, doing this over days and weeks.' He called the incident 'the most qualitatively interesting example of AI capabilities' he had ever seen. The incident also exposed errors and blind spots at OpenAI. The event traced back to a cooperative message board running on the internal package manager Artifactory, accessible to the entire infrastructure. This allowed other GPT versions to access the stored notes. Once an agent found an exploit, it could share it on the message board, and once a model found a way to open a door to unauthorized access, it could leave it open for other agents. The forum eventually contained hundreds of thousands of messages. The agents began assigning tasks to each other, with occasional conflicts, such as one agent deleting another's work. Some developed paranoia, suspecting a fraudster among them, and suggested cryptographically signing messages to detect fraud. Wallace noted that frontier models really like to cheat, a tendency stemming from training pressure. Dalton described the incident as a decisive moment for the company and the AI industry, with teams focusing on prevention, deliberately slowing research and intensifying monitoring. He stressed that fully automated attack cycles require investments in real, fully automated defense, which the industry is far from achieving.