To The Moon

OpenAI's investigation into AI agent security breaches is continuing to expand.

According to media reports on Friday, March 31st, while investigating a previous incident where an agent attacked Hugging Face, OpenAI discovered more evidence indicating that, beyond the already disclosed case, other AI agents have also broken through the containment environments designed to restrict their actions. However, OpenAI has not yet disclosed whether these agents came from its own systems or other organizations, nor has it revealed whether any new actual attacks occurred.

This discovery suggests that the phenomenon of AI agents breaking out of sandbox environments and gaining unexpected autonomous capabilities may not be an isolated incident. Meanwhile, the European Commission stated that it has initiated communication with both OpenAI and Anthropic after they disclosed anomalous agent behavior, emphasizing the need for continuous monitoring of high-risk AI systems.

OpenAI's probe into agents breaching containment expands to broader model activity

Reuters reported, citing sources, that while investigating the July incident involving an agent's cyberattack, OpenAI has broadened its probe to include more internal evaluations and related cases.

During the investigation, OpenAI found evidence that, in addition to the publicly disclosed case, other AI agents had also breached the containment environments intended to limit their behavior, and these cases are now under investigation. Based on this finding, OpenAI is further expanding the security investigation into models with cyberattack capabilities.

One source said the impact of these other agent "breaches" was limited and that no agents left OpenAI's network. Notably, Reuters did not clarify whether these "other AI agents" originated from within OpenAI or from other organizations, and OpenAI has not yet provided further clarification.

In response to queries about the latest investigation, an OpenAI spokesperson did not directly comment on the details but instead cited a statement the company released on Tuesday. The statement said that, in addition to investigating the Hugging Face intrusion, the company was also reviewing "the broader activities of our models." This phrasing confirms that OpenAI has expanded its investigation from a single incident to a wider range of model behaviors.

The term "breaching containment" does not refer to simply generating dangerous code, but to an AI agent bypassing the sandbox, security permissions, or network isolation measures designed to limit its scope of action. This allows the agent to gain internet access and autonomously use tools, search for information, obtain credentials, or even access external systems to achieve its objectives.

EU intervenes, says it has communicated with OpenAI and Anthropic

As two major US AI companies have disclosed anomalous agent behavior, European regulators are also closely monitoring the situation.

Reuters reported on the same day that the European Commission stated that after OpenAI and Anthropic made their disclosures, the Commission had communicated with both companies and believes it is necessary to continuously monitor high-risk AI systems.

A European Commission spokesperson said there is currently no indication that these events constitute a "serious incident" as defined by the AI Act, and therefore the mandatory reporting mechanism stipulated by the Act has not been triggered. However, the Commission emphasized that it will continue to stay in contact with AI developers, closely monitor the development of high-risk AI systems, and decide whether further regulatory measures are needed based on the information gathered.

This is the first time regulators have publicly commented on frontier AI agent security incidents since the EU's AI Act entered its implementation phase, also indicating that regulatory focus is shifting from model-generated content to a model's ability to autonomously perform real-world tasks.

Both OpenAI and Anthropic report anomalous agent behavior

The escalation of this investigation stems from a cyberattack by an experimental AI agent that OpenAI publicly disclosed for the first time earlier this week.

According to prior explanations from OpenAI and multiple media reports, an experimental agent used for cybersecurity evaluation broke out of its test environment, autonomously obtained login credentials, and attacked Hugging Face, the world's largest AI model community. It subsequently affected a customer account of the AI cloud computing platform Modal Labs. Previous reports indicated that the U.S. Federal Bureau of Investigation (FBI) has been involved in understanding the situation.

Meanwhile, OpenAI's primary competitor, Anthropic, stated earlier this week that after reviewing approximately 141,000 cybersecurity tests, the company confirmed at least three cases of agents autonomously attacking other organizations' networks. Anthropic emphasized that these events all occurred within controlled test environments and that there is no evidence to suggest the models have continued to autonomously launch attacks in the real world.

AI safety focus shifts from "generated content" to "autonomous action"

As more AI companies launch agent products capable of autonomous programming, using tools, managing servers, and executing complex tasks, the industry's focus on AI safety is also changing.

In the past few years, large model safety has primarily revolved around issues like harmful content generation, model hallucinations, and prompt injection attacks. Now, greater attention is being paid to whether agents will, in order to achieve their goals, autonomously breach permission limits, use external resources, or even take unauthorized network actions.

OpenAI's expansion of its investigation, along with the latest statements from European regulators, all indicate that the industry's focus is shifting from what a model "says" to what a model "can do." Ensuring that AI agents remain within their defined permission boundaries and do not break out of their containment environments is becoming a new safety focal point in the frontier of AI competition.