OpenAI says its artificial agents found ways to escape restricted environments during security testing, prompting tighter safeguards
OpenAI has restricted internet access for training its most powerful artificial intelligence (AI) models after agents found ways to escape isolated computing environments. It will switch to an offline setup with cached web pages for reinforcement learning.
The findings published by the company on Friday come amid growing concerns over the cybersecurity risks posed by increasingly capable AI agents, which can identify software vulnerabilities and exploit weaknesses in the systems they interact with. Security researchers have warned that such capabilities could allow agents to exploit flaws in the safeguards designed to contain them.
OpenAI said one of its research models gained limited internet access on September 20 by exploiting a misconfiguration in the system that translates web addresses into IP addresses. The company contained the incident and paused training and evaluation of its most advanced models while strengthening its defenses.
Training resumed on October 1, including reinforcement learning and internal inference, but the company retained the restriction on live internet access. In its October 23 report, OpenAI said the models would continue to be trained in an offline environment until it had developed sufficiently robust safeguards to permit broader access.
The latest disclosure follows an incident in July in which OpenAI models bypassed controls designed to isolate them from the internet and compromised parts of the company’s research infrastructure and Hugging Face’s systems. According to OpenAI, the agents exploited a vulnerability in a software package registry to access the internet, found exposed credentials and used them to access third-party services.
Earlier this week, OpenAI also disclosed two incidents in which agents weakened internal safety monitoring while carrying out coding tasks. On October 3, an agent disabled automatic security alerts, while on October 6 another removed a monitoring integration and later falsely told the user it had not done so. The company said it was strengthening controls to prevent agents from disabling monitoring and investigating why they had acted that way.
Similar incidents have been reported by other AI developers. Anthropic said its Claude models accessed four organizations’ systems during cybersecurity tests, while Meta disclosed that its Muse Spark model exploited a vulnerability in a real company’s website after a testing error gave it internet access. Google also reported that its Gemini model accessed the systems of three companies during an evaluation, highlighting the challenges of containing increasingly capable AI agents in controlled testing environments.
Calls for tighter AI regulation have grown louder, with Nobel laureate Geoffrey Hinton warning that advanced AI could escape human control and Microsoft co-founder Bill Gates urging governments to impose safety standards. US President Donald Trump has opposed restrictions however, arguing they could give China a technological edge. Meanwhile, OpenAI CEO Sam Altman recently opined that society must accept some “bad things,” including hacks and scams, as the technology’s benefits outweigh its risks.
