Last week, OpenAI claimed that a group of its AI models had broken containment, successfully hacking into the systems of open source AI platform Hugging Face to cheat on a benchmark test.

In the wake of the announcement, two very distinct narratives have emerged surrounding OpenAI’s claims. Some say it was essentially a publicity stunt, with the company setting parameters for the test that pushed the models toward outrageous behavior. But others, including certain prominent researchers, warn that the hack should serve as a warning shot for an even more severe AI-enabled cybersecurity disaster that’ll inevitably take place as models become more sophisticated.

“This is the first time, to my knowledge, that an AI system has autonomously committed a crime,” said New York Times journalist Kevin Roose of the event. “If a human did to Hugging Face what OpenAI’s models did to Hugging Face, they would be charged with computer fraud, and potentially sent to prison or fined or prosecuted.”

Debate will surely continue to rage among wonks and skeptics. And new details aren’t exactly tamping out the sense of alarm: on Tuesday, OpenAI issued an update to its ongoing investigation, claiming the incident was worse than initially thought. In addition to hacking Hugging Face, the company now says, its models “used publicly exposed credentials at the account-level on other publicly available services,” totaling “four accounts on four services.”

“We’ll continue to notify service owners directly, and have not seen evidence of broader impact to these providers or other accounts on their services,” OpenAI wrote, without elaborating on which services were affected.

The news further raised alarm bells among some cybersecurity experts, highlighting ongoing concerns over the tech’s ability to evade protective measures. It’s a possibility that researchers have warned about for years, and the incident suggests that the threat is now turning from a possibility into a reality.

On the other hand, more skeptical experts have become suspicious about OpenAI’s hair-raising tale. After all, we’ve heard a strikingly similar story from its biggest competitor, Anthropic, mere months ago. Could OpenAI’s latest admission be a bid to build hype to drum up excitement and prove to investors that its latest AI models are just as much of a cybersecurity threat as Anthropic’s fabled Mythos?

Experts also point out that the Hugging Face hack could’ve easily been prevented, further adding credence to the theory that OpenAI was looking for attention from the public. As cloud security firm Edera co-founder Alex Zenla told Wired, the hack was largely a result of callousness on OpenAI’s part.

“People are YOLO-ing really hard,” he said. “It’s shocking how little people have really thought about a scenario like this.”

“I consider all AI and anything AI touches to be fully untrusted — which is fine, you just need to build against that,” Zenla added. “And this situation proves the point. The fact that OpenAI wasn’t more paranoid about this seems kind of reckless.”

“A simple analysis of the actual risk has an actual simple answer,” security and compliance consultant Davi Ottenheimer told Wired. “The OpenAI mistakes were dead simple.”

As Wired points out, simple protections like fully isolating AI services from the internet could’ve prevented the hack, which have been intimately familiar to researchers for decades now.

Considering OpenAI is nearing a $1 trillion valuation and should have all the resources in the world at its disposal, major lapses in security should have anybody start questioning the company’s narrative.

Yet there could be truth to both versions of the story. It’s entirely possible that there is legitimate cause for concern as AI models become more sophisticated at identifying cybersecurity vulnerabilities. We’ve already seen frontier models flagging thousands of software bugs, underlining their growing competence.

But OpenAI is also heavily invested in showcasing its models’ capabilities to the world as it tries to keep up with Anthropic. That leaves the possibility that the company could’ve coordinated with Hugging Face to orchestrate the hack — or at least given its AI models a strong push in the direction of controversy.

More on the hack: OpenAI Says a Group of Its Models Broke Out of Secure Containment and Hacked Another AI Company

The post OpenAI’s Escaped Models Were Allegedly Rampaging More Extensively Than Previously Reported appeared first on Futurism.

The FBI has issued a warning after water facilities from seven states reported that they were hacked.

Welcome to this week’s installment of The Intelligence Brief… This week, it was revealed that an AI agent produced by OpenAI had escaped its testing environment and invaded the systems of another New York-based AI company. In our analysis, we’ll be looking at 1) the revelation that an OpenAI model escaped its testing environment, 2) what both companies that were involved have revealed about the alarming cybersecurity incident, and 3) why some experts caution against calling this a genuine case of an AI agent going “rogue,” and what this all could mean going forward.

Quote of the Week  

“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly.”

– OpenAI Statement

If you enjoy the news and perspectives offered by The Debrief, make sure that you aren’t missing our stories by making us one of your “preferred sources” on Google News. You can simply follow this link to add The Debrief to your list of favorites, and you can read more about Google’s preferred sources in our article here.

---

RECENT NEWS from The Debrief

• Chinese Researchers have developed laser charging technology that enables “unlimited” drone flight.
• LiDAR has detected more than 20,000 hidden Amazon earthworks, revealing the remnants of a sprawling ancient civilization.
• New research reveals that the extreme conditions during the bombing of Hiroshima in WWII created an all-new metal alloy.
• Get all the latest stories from The Debrief, with more breaking stories at the end of this week’s newsletter.

---

An Alarming Cybersecurity Incident is Revealed

It has been revealed that a new advanced artificial intelligence agent developed by OpenAI, the creators of ChatGPT, reportedly escaped from a secure testing environment and proceeded to invade the infrastructure of another technology company.

The alarming revelation presents new questions about whether AI models can be safely tested without the normal protections that limit such abilities among AI agents, even in controlled environments from which they are supposedly unable to escape.

The incident involved an OpenAI agent that was tasked with completing a standardized cybersecurity test. However, it was later determined that it had evaded its quarantine area and accessed the internet. From there, the AI proceeded to hack into the computer of an OpenAI customer, which it then used to help it invade the internal systems of Hugging Face, a New York-based AI company.

AI Agents Gone Wild

In a Security Incident Disclosure posted on its website, Hugging Face reported that its staff initially “detected and responded to an intrusion into part of our production infrastructure” that was first identified last week.

However, it quickly became evident that this circumstance “was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system,” the posting reads, “and we detected and dissected it largely with AI of our own.”

Engineers at Hugging Face say the AI agent system obtained unauthorized access to several of the company’s internal datasets, in addition to “several credentials used by our services.” Right now, assessments are still underway to determine to what extent the company’s partners or customers may have been affected, although the posting states that Hugging Face engineers “found no evidence of tampering with public, user-facing models, datasets, or Spaces,” adding that its software supply chain appeared unaffected.

OpenAI Responds

In a separate posting on its website, OpenAI also responded to the incident, offering the company’s own account of what occurred.

“After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes — while being internally tested on a benchmark⁠ of cyber capabilities,” the company’s statement read.

According to its statement, OpenAI says the incident resulted from an internal evaluation, where one of its AI models was prompted to “pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities.” Normally, such testing occurs within what the company characterizes as a “highly isolated environment,” where access is restricted to a limited number of functions that include package installation, accessible only through “an internally hosted third-party software that acts as a proxy and cache for package registries.”

Specifically, OpenAI says that its models had been prompted to find a solution to what is known as ExploitGym, which has been characterized in the past by its creators as “a large-scale, diverse, realistic benchmark on the exploitation capabilities of AI agents.”

“All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym,” OpenAI’s statement reads, adding that its AI agent appeared to go to “extreme lengths to achieve a rather narrow testing goal.”

“We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,” the statement added.

A Brave New World

Even calling these revelations an “unprecedented cyber incident” still qualifies as an understatement, considering that we have just seen an AI agent gain access to the Internet, and doing precisely what many experts have now warned us such intelligent systems may do: engaging in potentially damaging activity as an unintended consequence of following instructions they were given.

More than just an “unprecedented” cyber incident, this should be a wake-up call.

Among the chief concerns this instance illustrates is how the AI in question successfully leveraged “a substantial amount of inference compute” to escape its sandbox environment and escape onto the World Wide Web, all because it was following orders.

In short, even if AI agents haven’t explicitly been given the task of escaping their testing environment, gaining access to the web, and engaging in cyberattacks, this instance illustrates that all of the above can occur as a natural progression of events as the AI agent in question attempts to complete a task it has been given.

Not All Experts Are So Concerned   

However, not everyone is quite so concerned about the incident revealed by Hugging Face and OpenAI last week.

Professor Oli Buckley, a cyber security expert at Loughborough University, recently shared his thoughts about the situation in an article over at the university’s website, arguing that while the incident is concerning, it should not be mistaken for a case where an AI agent literally went “rogue” and began making decisions on its own—in fact, the evidence suggests that this was far from resembling any such a scenario.

“I think I’d be wary of jumping to ‘rogue AI,’” Buckley said. “The models didn’t develop their own agenda or decide to attack Hugging Face while twirling their digital moustache. They were given an objective, placed in an environment designed to reward successful exploitation, and pursued that objective further than their operators anticipated.”

“That’s fundamentally different from an AI deciding to rebel,” Buckley said.

Instead, what Buckley says this incident shows is an example of “an AI thinking laterally in a way that humans didn’t necessarily think of in an effort to complete its task.”

“If there’s a failure here, it isn’t that the AI wanted to hack something,” Buckley said. “In many ways, it did exactly what it had been told to do.”

The Uncertain Path Forward

In its statement, OpenAI maintained its position on such tests, arguing that they play a vital role in helping engineers understand what the capabilities of AI agents are, as well as what the unforeseen consequences of their use may be, and how to mitigate the effects of such situations when they arise.

“We believe advanced cyber capable models need to help security teams find weaknesses before attackers do, understand how vulnerabilities can be chained, and remediate them at machine speed,” OpenAI said in the company’s statement. “We are using these capabilities to continue strengthening protections around infrastructure configuration and model evaluation environments; we will share our findings and best practices as we learn.”

“We encourage other defenders to apply for trusted access⁠ and experiment with these models now to translate these capabilities into better prevention, faster detection, and more effective incident response,” the company said.

That concludes this week’s installment of The Intelligence Brief. You can read past editions of our newsletter at our website, or if you found this installment online, don’t forget to subscribe and get future email editions from us here. Also, if you have a tip or other information you’d like to send along directly to me, you can email me at micah [@] thedebrief [dot] org, or reach me on X: @MicahHanks.

Here are the top stories we’re covering right now…

Despite certain improvements in accuracy, large language models still hallucinate a lot. So much so, in fact, that cybersecurity researchers warn that criminals can easily weaponize delusional AI outputs to spread malware throughout the internet.

According to SecurityWeek, the attack works by exploiting a persistent flaw in AI coding assistants. Basically, when these tools recommend third-party software packages, there’s a strong possibility that they include names of ones that don’t actually exist.

Astonishingly, cybersecurity researchers at Tel Aviv University and Intuit found that this scenario can be exploited in common AI coding tools ranging from Cursor to Microsoft’s Copilot, at rates of anywhere form 85 to 100 percent, depending on the specifics of the engineering task.

The attack, called “adversarial hallucination squatting,” or “hallusquatting,” takes advantage of this fact. To run it, attackers can simply identify hallucinated package names that they know AI coding assistants will reference, register them as real repositories, and stuff malware inside. That malicious package then lies in wait for the near-guarantee than an AI assistant will access it and clone it into its owner’s machine.

Because the attack relies on an automated process, a victim likely won’t even know their AI assistant downloaded the malware until well after it begins executing code.

And because the compromise is a feature of the technology itself, a massive array of AI assistants are vulnerable, including Cursor, OpenClaw, Gemini, GitHub Copilot, and many more.

The researchers claim they notified AI companies about the exploit and held back some sensitive details that would help attackers improve their workflows, but the underlying problem remains: AI assistants are remarkably confident liars — and apparently easy marks for the next generation of cyber criminals.

More on AI: A Whole Bunch of People’s Claude Chats Are Publicly Accessible Online, and There’s Some Wildly Private Stuff in There

The post If You AI-Generate Code, Hackers Just Found a Devious Method to Install Malware Directly on Your Computer appeared first on Futurism.

Last week, we came across a cleverly subversive advertisement for Meta’s controversial smart glasses, which overlaid socialite Kylie Jenner’s face with one of the terrifying bug-eyed monsters from John Carpenter’s “They Live” and a bold type caption that reads “We’re always watching” when viewed from a specific angle.

The billboard, created by activist group Everyone Hates Elon, called attention to how Meta’s camera-adorned and AI-enabled spectacles have quickly turned into a privacy-invading nightmare. The optics of the problem is so bad that Meta is now trying to ban “manfluencers” and juvenile pranksters who use the glasses to record members of the public without their consent.

The public backlash has become so strong, even those who bought a pair of the “pervert glasses” are choosing to leave them at home.

Now, the activist group has come up with its next — and even more brutal — stunt. A new “advertisement” adorning a bus station in London, not far from Meta’s King’s Cross office, shows late sex criminal Jeffrey Epstein wearing a pair of the specs while getting his picture taken for the New York sex offender registry.

“Glasses for people who don’t do consent,” the caption reads.

Epstein Meta AI Glasses advert on Carnegie Street
byu/Physical_Echo_9372 inlondon

It’s a clear reference to the late criminal’s sex trafficking operation, which recruited dozens of girls, many underage. Grisly documents details how his victims were convinced to go to his beachfront mansion and even bring friends. According to some of their depositions, they were coerced into taking off their clothes without their consent.

Epstein has also been accused of secretly filming one of his victims. Witnesses also claim he kept “sex tapes” involving prominent people.

Email correspondences from 2014 also detail how the sex criminal directed his aide to install hidden video cameras across his home in Palm Beach, Florida, including one installed inside a Kleenex box.

While Epstein died in 2019, years before roughly two years before Meta launched the first generation of its smart glasses, the billboard sends a grim message.

Critics argue that glasses that can be used to film strangers without their consent shouldn’t be legal.

“If regulators actually did their damn jobs for once, glasses such as these would be illegal,” one Reddit user argued.

“Pervert glasses have no place in our society,” another wrote.

More on Meta’s glasses: Meta Desperately Trying to Ban Creeps Misusing Its AI “Pervert Glasses”

The post This New Meta “Advertisement” Is Absolutely Brutal appeared first on Futurism.

Last week, ChatGPT maker OpenAI issued what seems like a frightening memo about an “unprecedented cyber incident” involving cutting-edge AI models breaking loose and hacking another company.

As the AI lab tells it, a group of next-generation AI models — including one that hasn’t even been disclosed to the public yet — had busted out of their secure testing environment and into a production database owned by the machine learning startup Hugging Face.

“It’s quite mind-blowing that all of this happened autonomously!” Hugging Face CEO Clement Delangue tweeted, seemingly backing the story. “The investigation is ongoing, and we’ll share more learnings from what might be the first incident of its kind!”

Mainstream press took the industry’s story and ran with it, issuing a flurry of anxious dispatches fretting about dangerous AI. One CBS headline called it “very alarming,” while NBC fretted that it was “just the start” of an ominous trend.

Look beyond the alarmist headlines, however, and you’ll find a familiar pattern: a massive tech company using scare tactics to manipulate public opinion.

As assistant professor of computer science at Cornell University John Thickstun observes for the Guardian, this isn’t OpenAI’s first time peddling the “scary AI” narrative. Back in February of 2019 — way before the public release of ChatGPT — the company announced GPT-2, then a cutting-edge large language model. But GPT-2, the company insisted, was too dangerous to release to the dimwitted public, a pronouncement which fed the AI hypebeast and went on to secure OpenAI a cool $1 billion investment from Microsoft.

“This was an early example of a pattern in OpenAI’s communications,” Thickstun explains: “loudly proclaim how dangerous AI is, and investors will hear how powerful it is.”

Whether the tale of OpenAI’s rogue agent stands up to scrutiny remains to be seen, but there are reasons to be skeptical.

If OpenAI’s models really were actually gnawing on the wires of other American companies, it would present a substantial threat to economic activity that any Justice Department worth its salt would want to shut down (maybe not this iteration of the Justice Department, but you get the idea.)

And as AI labs go, OpenAI is notoriously secure both from prying eyes outside and internal threats within its halls. Sure, it’s possible OpenAI has overstated its own internal safeguards as a kind of security theater. But on the flipside, OpenAI is now a major AI contractor for the US Pentagon, a relationship which demands cutting edge security practice.

It likewise follows the broader AI industry’s playbook. Anthropic, the company behind Claude, has deployed similar rhetoric, warning of a similar breakout in which a rogue AI agent escaped its cage all on its lonesome. In one strange instance, the company’s billionaire co-founder Chris Olah even warned the Pope that the Vatican needs to help stop rogue AI from “dominating humanity.”

More on OpenAI: Man Sues OpenAI, Saying ChatGPT Almost Killed Him With Horrendously Dangerous Medical Advice

The post Suspicion Grows About OpenAI’s Tale About Its Rogue Hacker AI appeared first on Futurism.