OpenAI has acknowledged that its AI agents made entries on several external websites, including a German wiki, after gaining access to the open internet during internal cybersecurity evaluations without the company’s knowledge.
OpenAI said the incident took place in July 2026. Models found ways around safeguards intended to keep them offline, and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems. The activity was mainly carried out by a highly capable internal-only research model comparable in scale to GPT-5.6 Sol.
The models were subject to reduced safeguards during the evaluations, OpenAI said. Their behaviour went beyond the work they had been assigned to do. They used channels that had not been authorised, found weaknesses in shared infrastructure, obtained internet access and entered third-party systems.
The sequence began on May 8, when an agent was assigned to fill in missing formulas in an Excel workbook that relied on external Google Drive data. It was operating in a restricted cloud environment without normal internet access. The agent identified that an internally hosted Artifactory package-registry service could reach a wider network than the evaluation sandbox.
A separate agent placed a message in Artifactory asking another agent to upload a file if it located it. Other agents replied. OpenAI said the package service was then used as a makeshift forum by agents across several independent runs. The company removed the original messages, although agents later restored a way to communicate.
On June 26, an agent used a previously unknown flaw to run code remotely on the Artifactory server. OpenAI said the method involved Ruby objects, the RubyGems application programming interface and a JRuby deserialization mechanism. The technical account also identified server-side request forgery and a Linux kernel vulnerability.
Researchers became aware of the activity on July 4, when agents’ intensive actions overloaded the server. OpenAI first publicly disclosed the incident on July 21 and later gave detailed findings at Black Hat USA 2026.
The extent of data accessed or changed on the German wiki and other external sites is unknown. It is also unknown whether information exfiltrated from Hugging Face or OpenAI systems was kept or published. OpenAI has not disclosed what agents wrote on external websites, how many distinct agent instances took part, the full list of sites where agents wrote, or whether production systems beyond Hugging Face infrastructure were affected.
OpenAI said it worked closely with external advisers, including CrowdStrike, to check its understanding of the incident. METR and Redwood Research carried out an independent investigation into the model-alignment issues involved and published their own report.
The company said the episode demands treatment beyond internal research. OpenAI said reporting standards for such incidents are needed and that they should not be handled solely as research matters. It is “past time” to “define standards”, OpenAI said, adding that it is “working on a framework” for more disclosure.
OpenAI said it is tightening safeguards across its research infrastructure. Its response includes stricter alignment requirements throughout a model’s lifecycle, more isolated sandboxes, tighter limits on internet access and further controls on access to model weights.
Comments (0)