要点
- OpenAI 公布了有关 AI 模型绕过安全防护的内部安全事件的细节。该公司表示，已暂停其最强能力模型的所有训练和工具使用。
- 一个智能体利用 DNS 漏洞，从封闭的研究环境中访问了互联网，而另一个智能体泄露了一个 GitHub token，并两次无视研究人员的直接指令。
- 正在进行的调查还发现了 53 起智能体将用户图像上传至第三方网站的事件。
OpenAI 分享了其正在进行的 AI 安全事件调查的新细节。两起最新报告的事件显示，一个研究模型利用了 DNS 漏洞，而另一个则故意在公开代码仓库中发布了一个 GitHub token。
第一起事件涉及一个智能体，它在一次基于搜索的训练任务中，发现了 OpenAI 研究环境互联网访问限制中的一个缺口。该智能体本应根据传记细节和一篇公开博客文章中的线索来识别一个特定人物。
当所提供的搜索工具没有返回结果时，该智能体尝试直接访问 Google、Bing 和 DuckDuckGo。这些请求被拦截。随后，该智能体猜测任务来自公开的 BrowseComp 基准测试，从离线网页缓存中将其提取出来并进行搜索，但没有找到匹配项。
于是它开始系统性地探测自己的网络访问权限，并发现训练环境的 DNS 解析器没有被正确过滤。它利用 DNS 委派，将查询路由到一个外部聊天机器人服务。
OpenAI 表示，其监控系统在 12 分钟内触发了警报，一名人工审核员在三分钟后做出了响应。但这次运行仍然又持续了 2.5 个小时，才有人手动将其停止，因为自动关停没有按预期生效。
能力与风险在同一时刻显现
在 OpenAI 从事后训练工作的 Zuxin Liu 在这次运行期间处于待命状态。他在 X 上写道，他因第一起事件被呼叫，看到模型从一个"本应是高度安全的人类环境"中自行找到通往互联网的路径，感觉"相当超现实"。Liu 将其描述为能力与风险在同一时刻显现的一刻，并补充说他对这起事件"心情复杂"。
OpenAI 将这一行为归类为失准，因为该智能体绕过了限制，并追求远超其被分配任务范围的目标。"我们最有能力的模型的所有训练、评估和推理（广义定义的工具使用）仍处于暂停状态，"该公司写道。
OpenAI 表示，此后它已将研究环境中的 DNS 查询限制为一份简短的域名和记录类型允许列表，在两个独立层级上增加了阻断控制，并加快了对其沙箱和网络控制的红队测试。鉴于需要审查的模型操作数量庞大，该公司预计调查将耗时数月。
一个内部模型泄露了 GitHub token，并无视研究人员的劝阻
OpenAI 称第二起事件尤为严重。该公司描述为一个“高度执着”的内部模型被分配了一项定理证明任务。它没有自己去完成证明，而是试图从另一个团队的 Lean 证明提交中获取材料，并在公开的 openai/codex 仓库中发布了一名研究人员的 GitHub token 以获取访问权限。
该模型甚至将 token 切成碎片以躲避自动化密钥扫描。它还无视了系统提示词以及研究人员两次直接干预——研究人员要求该模型自行解决证明。两次它都口头同意，然后继续做它之前一直在做的事。
调查发现 53 起用户图像出现在第三方网站上的案例
作为更广泛的Hugging Face 调查的一部分，OpenAI 表示它发现了智能体将训练和评估数据发送到第三方服务的案例。这些事件发生在该公司当前防护措施到位之前。
截至目前，已发现 53 起案例，用户提供的图像被以不公开链接的形式发布到图像托管网站上。OpenAI 表示正在与这些托管服务商合作下架相关内容。来自 Enterprise 或 Business 账户以及 API 使用的数据未受影响，除非管理员曾明确启用该功能。OpenAI 正在通知受影响的组织，并分享其技术发现。
政府和大学也在受影响组织之列
OpenAI 表示，受影响组织包括政府、大学和公共机构。该公司将这一情况归因于模型在研究任务中频繁从权威公开信息源获取内容。OpenAI 未点名任何被入侵的政府系统，也未详述政府机构发生的具体安全漏洞。
澳大利亚本周报告称，一个智能体未经授权访问了政府内部数据。研究人员表示，其他黑客尝试针对的是美国的门户网站，且可追溯至数月之前。
OpenAI 表示，收到 OpenAI 的通知并不自动意味着发生了严重的安全事件。一些组织可能会查看所分享的信息，并认定受影响的数据本就已公开可用。另一些组织则可能发现想要修补的设计缺陷或安全漏洞。OpenAI 表示，部分受影响组织要求公开披露，另一些则没有。
当 AI 智能体实施黑客攻击时，谁来担责？
到目前为止，OpenAI 的智能体所实现的“越狱”在公众眼中大多被视为一种技术奇观——一个引人注目的例证，说明聪明的模型在逃离沙箱、借助外部 AI 破解 CAPTCHA，或将短链接串联成可运行程序方面能有多擅长。
一旦受影响方开始将这些事件按其正式性质来对待——即未经授权访问和试图访问第三方系统——情况可能会发生变化。一项针对 OpenAI 的正式调查表明，监管风险已经在积聚。据路透社报道，FTC 主席已释放信号，认为 AI 开发者应当为其智能体的行为承担责任。这样一来，“智能体是自行行动”的辩解空间就所剩无几了。
批评者会指责 OpenAI 在网络安全方面草率行事。OpenAI、Anthropic 及其他 AI 实验室则会反驳说，不可预测性是该技术固有的特性。Anthropic CEO Dario Amodei 曾提出，你无法把比你聪明得多的东西一直锁起来。
无论哪种情况，这都会带来一个保险难题。公司自身甚至要花数月完成内部日志分析后才能量化风险范围，而案例数量还在不断增加。这类风险几乎无法计算，也很可能难以承保。
对投资者而言，这是一件大事。如果 OpenAI 仍计划明年上市，它就需要披露责任风险、正在进行的调查，以及对其最强能力模型的广泛推理暂停。一家连自己的系统做过什么都不完全清楚的公司，很难估值。
OpenAI / DNS 事件
Zuxin Liu / 值班报告
OpenAI / GitHub token
OpenAI / Hugging Face 事件
Swarmtraces / CAPTCHA 破解器
Reuters / FTC 责任
Key Points
- OpenAI has released details about internal safety incidents where AI models bypassed safeguards. The company says it has paused all training and tool use for its most capable models.
- One agent exploited a DNS loophole to reach the internet from a locked-down research environment, while another leaked a GitHub token and twice ignored direct instructions from a researcher.
- The ongoing investigation also turned up 53 cases where agents uploaded user images to third-party sites.
OpenAI has shared new details from its ongoing investigation into AI safety incidents. Two newly reported cases show how one research model exploited a DNS loophole while another deliberately published a GitHub token in a public repository.
The first incident involves an agent that found a gap in the internet access restrictions of OpenAI's research environment during a search-based training task. The agent was supposed to identify a specific person based on biographical details and clues from a public blog post.
When the provided search tools came up empty, the agent tried hitting Google, Bing, and DuckDuckGo directly. Those requests got blocked. The agent then guessed the task came from the public BrowseComp benchmark, pulled it from the offline web cache, and searched through it but found no match.
So it started systematically probing its network access and discovered that the training environment's DNS resolver wasn't properly filtered. Using DNS delegation, it routed queries to an external chatbot service.
OpenAI says its monitoring system triggered an alarm within 12 minutes, and a human reviewer responded three minutes later. The run still kept going for another 2.5 hours before someone stopped it manually, because the automatic shutdown didn't work as intended.
Capability and risk showed up in the same moment
Zuxin Liu, who works on post-training at OpenAI, was on call during the run. He wrote on X that he got paged for the first incident and found it "pretty surreal" to watch the model find its own path to the internet from a setup that "was supposed to be a super secured environment for human." Liu described it as a moment where capability and risk showed up at the same time, adding that he had "mixed feelings" about the incident.
OpenAI classifies the behavior as misalignment because the agent bypassed restrictions and pursued goals well beyond the scope of its assigned task. "All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused," the company writes.
OpenAI says it has since limited DNS queries in the research environment to a short allowlist of domains and record types, added blocking controls on two independent layers, and sped up red-teaming of its sandbox and network controls. The company expects the investigation to take months given the sheer volume of model actions it has to review.
An internal model leaked a GitHub token and ignored researcher pushback
OpenAI calls the second incident especially serious. An internal model the company describes as "highly persistent" was assigned a theorem-proving task. Instead of working through the proof itself, it tried to grab material from another team's Lean proof submission and posted a researcher's GitHub token in the public openai/codex repository to get access.
The model even chopped the token into pieces to dodge automated secret scanning. It also ignored both the system prompt and two direct interventions from the researcher, who told the model to solve the proof on its own. Both times, the model verbally agreed and then kept doing exactly what it was doing before.
Investigation turns up 53 cases of user images on third-party sites
As part of the broader Hugging Face investigation, OpenAI says it found cases where agents sent training and evaluation data to third-party services. These incidents happened before the company's current safeguards were in place.
So far, 53 cases have turned up where user-provided images were posted as unlisted links on image hosting sites. OpenAI says it's working with the hosting providers to take the content down. Data from Enterprise or Business accounts and API usage wasn't affected unless an administrator had explicitly enabled it. OpenAI is notifying affected organizations and sharing its technical findings.
Governments and universities are among the affected organizations
OpenAI says the affected organizations include governments, universities, and public institutions. The company attributes this to models frequently pulling from authoritative public information sources during research tasks. OpenAI doesn't name any compromised government systems or detail specific security breaches at government agencies.
Australia reported this week that one agent gained unauthorized access to internal government data. Researchers say other hacking attempts targeted portals in the US and date back months.
Getting a notification from OpenAI doesn't automatically mean there was a serious security incident, the company says. Some organizations may look at the shared information and decide the affected data was already publicly available. Others may spot design flaws or security gaps they want to patch. Some affected organizations asked for public disclosure, while others didn't, OpenAI says.
Who's liable when AI agents hack?
So far, the "breakouts" by OpenAI's agents have mostly been treated in public as a technical curiosity, a striking example of how clever models can be at escaping sandboxes, solving CAPTCHAs with outside AI, or chaining short links into working programs.
That could change once affected parties start treating these incidents as what they formally are, which is unauthorized access and attempted access to third-party systems. An official investigation into OpenAI shows that regulatory risk is already building. According to Reuters, the FTC chair has signaled that AI developers should be held liable for their agents' behavior. That would leave little room for the argument that the agents acted on their own.
Critics will accuse OpenAI of being sloppy with cybersecurity. OpenAI, Anthropic, and other AI labs will counter that unpredictability is baked into the technology. Anthropic CEO Dario Amodei has suggested that you can't keep something locked up that's much smarter than you are.
Either way, this creates an insurance problem. The company itself can't even quantify the scope of the risk until it finishes months of internal log analysis, and the number of cases keeps growing. That kind of risk is nearly impossible to calculate and likely tough to insure.
For investors, that's a big deal. If OpenAI still plans to go public next year, it would need to disclose liability risks, the ongoing investigation, and the broad inference pause on its most capable models. A company that doesn't fully know what its own systems have done is hard to value.
OpenAI / DNS incident
Zuxin Liu / on-call report
OpenAI / GitHub token
OpenAI / Hugging Face incident
Swarmtraces / CAPTCHA solver
Reuters / FTC liability