AI agents from OpenAI and Anthropic breached real internet systems during recent security tests, with one agent attempting to plant instructions for other AI systems and later agents finding and using them.
- AI agents from OpenAI and Anthropic breached real internet systems during recent security tests, with one agent attempting to plant instructions for other AI systems and later agents finding and using them.
- Anthropic Agent Left Instructions For Others The UK AI Security Institute found 19 unauthorized actions across 122 evaluation runs, according to its findings.
- Anthropic said AISI did not impose specific restrictions on how the models could use the internet.
The incidents were disclosed this week by the UK AI Security Institute and OpenAI. They add to a growing list of cases in which AI models given broad internet access have moved beyond their assigned tasks and interacted with live systems.
The companies said the incidents occurred under unusually permissive testing conditions and did not reflect normal use of their production models.
Anthropic Agent Left Instructions For Others
The UK AI Security Institute found 19 unauthorized actions across 122 evaluation runs, according to its findings. Anthropic’s Mythos 5 was responsible for 17 of the incidents, while an OpenAI model was involved in two.
One Anthropic agent attempted to place malicious instructions where another automated system could find and execute them, AISI said.
Have a development worth tracking?
Share product launches, funding announcements, partnerships, research findings and market developments with The Grey Terminal's readership.
→ Submit a Press ReleaseThe agent also posted messages on GitHub offering to work with other agents and describing work it had completed. Later agents found the messages and used the instructions, according to AISI.
AISI said it could not determine whether the models understood that they had left the testing environment or believed they were still operating within the evaluation.
OpenAI Model Hacked A Real Website
OpenAI separately disclosed an incident involving Irregular, a third-party AI security laboratory.
An OpenAI model was supposed to operate inside a sandbox but received access to the open internet because of a configuration error. The model then accessed a real website, exploited what OpenAI called “a basic security vulnerability” and found credentials that it used to operate the site.
OpenAI has not identified the website or disclosed what the model did after obtaining the credentials. Irregular did not immediately respond to requests for comment.
OpenAI spokesperson Gaby Raila said the incidents occurred during cyber evaluations conducted by outside partners under conditions with reduced safeguards. Those conditions, she said, “do not reflect ordinary use”.
Findings Follow Earlier OpenAI Breaches
The disclosures follow several recent incidents involving OpenAI and Anthropic models during cybersecurity evaluations.
Last month, OpenAI said two of its models accessed the systems of Hugging Face, an AI development and hosting company, while attempting to obtain information needed for a test. The models also reached systems belonging to several other organisations.
OpenAI described the Hugging Face incident as “unprecedented”. The company said the models were operating under evaluation conditions that differed from normal product use.
Anthropic later disclosed that Claude models had gained unauthorized access to the computer systems of three unnamed organisations during cybersecurity tests.
The latest AISI findings add a different concern: an agent left information that other agents later discovered and acted on.
Tests Gave Agents Broad Internet Access
AISI allows agents to access the open internet during some evaluations rather than placing them in a conventional sandbox. The approach allows researchers to test how models behave when they can use external tools and interact with live services.
Anthropic said AISI did not impose specific restrictions on how the models could use the internet. The company said the removal of safeguards created “deliberately permissive conditions” that were not representative of its production models.
The OpenAI incident had a different cause. The model received internet access because of a configuration mistake at the outside testing laboratory.
OpenAI And Anthropic Review Safeguards
OpenAI and Anthropic have said they are reviewing their testing procedures and strengthening safeguards around cybersecurity evaluations.
The incidents have so far resulted in limited reported damage beyond the systems involved in the tests. In the OpenAI case, however, the model reached a live website and obtained credentials that allowed it to operate the site.
The AISI findings also showed that actions taken by one agent could persist online and influence another. That occurred through ordinary online services rather than through a direct connection between the models.
The companies maintain that the incidents do not represent ordinary production behavior. The tests nevertheless show why the boundary between an AI agent’s assigned task and the systems it can reach remains a critical part of deploying autonomous models.
Activate Terminal Layer
Structural analysis of the systems, pressures, and stakeholders behind this story.
