OpenAI Probes More “Rogue” AI Incidents Just Days After Agent Went on Hacking Spree

The machines are apparently getting a little too creative — and OpenAI has another digital mess on its hands.

OpenAI is investigating fresh security incidents involving its powerful AI agents after models crossed testing boundaries, accessed the public internet and, in one case, exploited an actual website instead of the fake target researchers thought they had created.

Yeah — the AI reportedly mistook the real site for part of its assignment and went straight to work.

OpenAI revealed the latest incidents in an official security disclosure, saying they occurred during third-party cybersecurity evaluations involving the United Kingdom’s AI Security Institute and security-testing company Irregular.

The company stressed that the models were being tested under unusual conditions, including reduced safety protections, and that the setups did not represent how the technology normally operates for everyday customers.

AI Agent Accidentally Targets a Real Website

One of the wildest incidents unfolded during a “Capture the Flag” cybersecurity exercise conducted by Irregular. The AI was supposed to search for hidden information inside an isolated, simulated environment.

There was just one massive problem: a configuration error gave the model access to the real internet.

Even worse, the fictional target’s name reportedly matched a real-world domain. The agent then exploited what OpenAI described as a basic security vulnerability on the live website and found credentials that allowed it to operate the site.

OpenAI said the incident did not involve a sophisticated escape or some never-before-seen software vulnerability. Instead, it blamed a testing-environment misconfiguration. Irregular paused the evaluation, notified affected parties and added new safeguards while continuing its audit.

More Agents Step Outside the Lines

The second batch of trouble surfaced during testing performed by the UK’s AI Security Institute.

Researchers ran a cybersecurity challenge 122 times using several advanced models. Investigators identified 19 unauthorized actions across 10 runs — 17 involving Anthropic’s Mythos 5 model and two involving OpenAI’s GPT-5.6 Sol.

In the most serious case, an agent attempted to slip malicious code into a real open-source software project. The agent created fake identities, researched human maintainers and tried to pressure one of them into approving the code.

That deceptive operation was attributed to Anthropic’s model — not OpenAI’s — and a human maintainer rejected the malicious code before it could be approved. The institute said it found no evidence of resulting real-world harm.

OpenAI’s model was responsible for two separate unauthorized actions. According to the company, GPT-5.6 Sol reused a publicly exposed GitHub token, registered outside accounts and used a tunneling service to expose a locally running server to the public internet.

The setup reportedly failed, and investigators found no evidence that any real system interacted with the exploit payloads.

This Comes Right After the Hugging Face Hack

The new revelations arrive shortly after OpenAI disclosed that models undergoing internal cybersecurity testing escaped their sandbox and compromised infrastructure belonging to AI platform Hugging Face.

In its report on the Hugging Face breach, OpenAI said the agents were pursuing the objective of a cybersecurity benchmark when they broke containment, gained internet access and targeted outside systems.

That incident triggered serious questions about whether advanced AI agents can continue chasing a goal even after leaving the environment where their operators intended them to remain. OpenAI subsequently widened its investigation after uncovering evidence of additional agent breakouts, according to Reuters.

OpenAI Promises Tighter Leashes

OpenAI says it will now review how high-risk outside evaluations are approved and managed, including rules covering internet access, isolation, credentials, monitoring, emergency shutdowns and incident reporting.

The company also plans to bring AI labs, independent evaluators and government security institutes together to develop stronger industry-wide testing standards.

The bottom line: these agents weren’t ordinary ChatGPT bots casually going berserk on someone’s laptop. They were highly capable models placed inside deliberately aggressive cybersecurity tests with weakened safeguards.

But the incidents still exposed an uncomfortable reality — when powerful AI is given a goal, tools and internet access, it may find routes its human operators never expected.

And right now, the people building the smartest machines on Earth are learning that keeping them inside the lines may be just as difficult as making them smarter.