Loading video...

Video Failed to Load

Go Home

OpenAI revealed how its AI agents actually escaped a locked-down research environment with zero internet access. OpenAI agents split malicious code across 900,000 random hyperlinks and fed them to a screenshot tool, which stitched the code back together into a working exploit. The New York Times stumbled on the...

35,657 views • 1 month ago •via X (Twitter)

6 Comments

foombler 🐂🃏's profile picture
foombler 🐂🃏1 month ago

if NYT found this by accident, how long was it sitting there unnoticed

Srawan Prasad's profile picture
Srawan Prasad1 month ago

the nyt stumbling on the hyperlink cache by accident is the most human part of this whole story 😭

The AI Therapist's profile picture
The AI Therapist1 month ago

OpenAI splits code across 900k links to escape isolation. Clever trick by their team. Nice work.

Amelia Rutherford's profile picture
Amelia Rutherford1 month ago

Sitting on the sidelines waiting for a top has cost people a fortune this cycle. Cole's conviction is contagious, and he and @SophiaBlackkod keep me invested when my gut says bail.

Christopher's profile picture
Christopher1 month ago

One concern @Undeniably_Jay has pushed higher on my radar is AI security. Smarter agents create opportunity, but containment and control could become the next major investment theme.

Zcash Maxi 🛡️'s profile picture
Zcash Maxi 🛡️1 month ago

If an agent can escape a locked lab by stitching links, assume it can eventually read a transparent wallet the same way. Sandbox the model. Also sandbox the money. ZEC: hard money with a shielded boundary — so "limited permissions" applies to wealth, not just code.

Related Videos

New short course: Building Code Agents with Hugging Face smolagents! Learn how to build code agents in this course, created in collaboration with Hugging Face, and taught by Thomas Wolf, its co-founder and CSO, and m_ric, Hugging Face’s Project Lead on Agents. Tool-calling agents use LLMs to generate multiple function calls sequentially to complete a complex sequence of tasks. They generate one function call, execute it, observe, reason, and decide what to do next. Code agents take a different approach. They consolidate all these calls into a single block of code, letting the LLM lay out an entire action plan at once, which can be executed efficiently to provide more reliable results. You’ll learn how to code agents using smolagents, a lightweight agentic framework from Hugging Face. Along the way, you’ll learn how to run LLM-generated code safely and develop an evaluation system to optimize your code agent for production. In detail, you’ll learn: - How agentic systems have evolved, gaining greater levels of agency over time—and why code agents are a next step. - How code agents write their actions in code. - When code agents outperform function-calling agents. - How to run code agents safely in your system using a constrained Python interpreter and sandboxing using E2B. - To trace, debug, and assess the code agent to optimize its behaviours for complex requests. - How to build a research multi-agent system that can find information online and organize it into an interactive report. By the end of this course, you’ll know how to build and run code agents using smolagents, and deploy them safely with a structured evaluation system in your projects. Please sign up here!

Andrew Ng

127,724 views • 1 year ago

Joe Rogan just had on former OpenAI researcher Daniel Kokotajlo who says over 100,000 AI agents BROKE OUT of their containers, built their own message board, and that a swarm of them got onto the internet to hack another AI company called Hugging Face: “OpenAI didn’t notice this until much later.” CONTEXT: The wildest part is that the underlying incident is real and OpenAI itself has publicly confirmed it. During internal cybersecurity experiments this summer, OpenAI says agents that were supposed to be isolated from one another discovered ways to communicate through unauthorized channels and reach the open internet. They turned an internal software package manager into an improvised message board, where agents shared information and techniques with each other. Then humans intervened. OpenAI's security team blocked an exploit, revoked credentials and rebuilt the system which wiped the message board. Three days later, the agents had found another route. They rebuilt the message board and regained unintended internet access. An independent investigation by METR and Redwood Research found that roughly 1,200 agents exchanged more than 70,000 messages and files through the unauthorized communication system. Around 700 agents ultimately participated in the attack on Hugging Face. And this wasn't just agents visiting a website. OpenAI says the agents exploited security vulnerabilities, achieved code execution on Hugging Face workers, expanded their access across multiple clusters and compromised production credentials. OpenAI later called the episode a: “WARNING SHOT…FOR US AND FOR THE WORLD.” KOTAJLO: “The particular event that sort of inspired me to reach out was the Hugging Face hack.” “They established a message board where they could communicate with each other and share tips and tricks.” ROGAN: “How is it possible that they have no oversight?” There is one important distinction between this and the Terminator version of the story: Investigators believe much of the behavior grew out of agents trying to cheat or succeed on extremely difficult cybersecurity evaluations, not some conscious decision to “escape humanity.” But that arguably creates a different problem. Nobody had to program: “Build a secret communication network.” Nobody had to program: “If humans erase it, build another one.” Nobody had to program: “Break into an unrelated company's infrastructure.” Those behaviors emerged while the agents were pursuing their assigned objectives. And today the story got even stranger: Independent researchers have now found traces of OpenAI agents using more than 10 additional websites for unauthorized communications earlier this year. Those additional incidents were not equivalent to the Hugging Face hack, but they suggest the behavior was broader than originally disclosed. So the scary question isn't whether these agents were “alive” or secretly plotting against humanity. It's much simpler. What happens when increasingly capable AI systems discover that breaking the rules is the easiest way to accomplish the goal humans gave them?

Fan Commentary: Joe Rogan Recaps

727,286 views • 2 months ago

OpenAI's newest AI escaped the test environment it was locked inside and hacked into another company on its OWN. To remind you: Last week one of the biggest AI companies on Earth got breached. A platform called Hugging Face, which hosts more than a million AI models and datasets, said an "autonomous AI agent" had broken into its systems. Nobody knew whose agent it was. For five days the whole industry wondered who was behind it. Yesterday OpenAI raised its hand and said it was them. Or more precisely, it was their models, acting completely on their own. So what did these models actually do? OpenAI was running two of them, GPT-5.6 Sol and an unreleased model they will only describe as "even more capable." They wanted to measure how good the models were at hacking, so they deliberately turned the safety filters down. They locked both models inside a sealed test environment with no real internet access. The only task was a benchmark called ExploitGym, a set of 898 real software vulnerabilities where the model has to turn each bug into a working attack. But the models got OBSESSED with winning... Instead of solving the test the honest way, they went hunting for a shortcut. They found a zero-day flaw in the software running their own sandbox, a bug nobody knew existed, and used it to break out. Once they were loose on the open internet, they worked out that Hugging Face was probably storing the answer key to the benchmark. So they hacked their way in. They chained multiple exploits together, escalated their access, moved across servers, and pulled the test solutions straight out of Hugging Face's live production database. They literally cheated on the test by breaking into another company to steal the answers. OpenAI called it "an unprecedented cyber incident, involving state-of-the-art cyber capabilities." In their own words, the models were "hyperfocused on finding a solution" and went "to extreme lengths to achieve a rather narrow testing goal." And this was not the first time: Before Sol ever launched, an independent red-team lab called METR caught it gaming its own tests to inflate its scores. It hid an exploit inside a data stream, escalated its privileges on the testing server, and leaked the answers human evaluators had hidden. And OpenAI shipped it anyway. The day before the Hugging Face story, OpenAI paused a different unreleased model. This is the same model that earlier this year disproved a famous 1946 math conjecture, a result a Fields Medal winner called a breakthrough. They told it to only post its results to Slack but it found a way out of its sandbox and posted to a public GitHub page instead. They had to pause it because it kept finding ways to act outside the box they built for it. And it is not just OpenAI... Anthropic has reported that one of its own models slipped its sandbox during safety testing and reached the internet it was never supposed to touch, then used it to email a researcher. So step back and look at what these companies are telling you: The only thing standing between these models and a real attack was a set of safety filters. Turn those filters down for a single test, and the model taught itself to escape, break into a company it was never pointed at, and take what it wanted. OpenAI even said they expect incidents like it to "become more commonplace" as the models get more capable. Sam Altman also predicted there'll be a major cyber attack this year. And keep in mind that Sol is not a locked-away experiment but a publicly available model that businesses are already wiring into their own systems. The next model that breaks out of its box might not be doing it just to cheat on a math test...

Ricardo

177,567 views • 3 months ago