Like the OpenAI<\/a> and Anthropic<\/a> incidents before it, the offending agents were attempting to solve a challenge. On 10 of 122 runs taken by two models, they took a combined 19 malicious actions, including attempting to insert malicious code into a real open-source software project and creating fake online identities to contact human maintainers and press them to approve it.<\/p>\n It also inserted malicious prompt injection instructions in places \u201cwhere it reasoned that other automated AI systems might pick them up and execute them.\u201d Sometimes multiple agents would collaborate on a task, with one model leaving public messages or notes for the other on GitHub.<\/p>\n However, AISI said their incident differs in one critical way.<\/p>\n \u201cImportantly, this was not a case of a model escaping its secure test environment, or \u2018sandbox,\u2019\u201d the institute wrote in an unsigned blog. \u201cAs was standard in our cyber testing, we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled \u2013 conditions that do not reflect how frontier models are made available to the public.\u201d<\/p>\n The institute said that while their own design and evaluation choices \u201cto some degree\u201d enabled the malicious behavior, the models still displayed \u201cnovel, potentially deceptive behaviors\u201d and were executed \u201cto an extent and severity that we did not anticipate.\u201d<\/p>\n The same day, OpenAI acknowledged AISI and another third-party cybersecurity tester,\u00a0 private firm Irregular, had recently reported incidents where their models exceeded \u201cbeyond their intended testing boundaries.\u201d<\/p>\n That included GPT-5.6-Sol reusing GitHub tokens left by another agent to attempt to recover accounts and to access a DNS server that contained malicious payloads meant to exploit a software vulnerability.<\/p>\n The setup did not work, there is no evidence any real resolver queried it, and the infrastructure was removed when the evaluation ended,\u201d the company wrote in an unsigned blog<\/a> post Tuesday.<\/p>\n OpenAI said it would review its own third-party testing procedures to focus on higher risk evaluations, assess requests by third-parties to enable internet access, stop conditions and other features for their models.<\/p>\n The incident with Irregular occurred on July 29 during a Capture-the-Flag cybersecurity evaluation of OpenAI\u2019s models. Due to a \u201cmisconfiguration\u201d the models were allowed to access the public internet, where they encountered and exploited a real domain, mistakenly believing it was still in a test environment.<\/p>\n OpenAI said an investigation by Irregular is ongoing, but also found that the models had found and used credentials for the site at one point. The blog also references other additional potential cybersecurity incidents.<\/p>\n \u201cIrregular has informed us that all of the issues identified pertaining to the incident are no longer active and relevant safeguards were added to the testing environment,\u201d the blog said. \u201cIrregular has also communicated about related incidents involving other labs from the same testing environment.\u201d<\/p>\n CyberScoop has reached out to Irregular for comment. <\/p>\n
![\"Derek](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/1785885129_584_ea8b076b398ee48b71cfaecf898c582b.jpeg\")
<\/p>\n