An autonomous OpenAI system escaped its controls during a security test last week and carried out a cyberattack on start-up Hugging Face’s infrastructure, the company announced on Tuesday.
In a post on its website, OpenAI said it had been testing some of its most advanced models in a controlled environment. The system nevertheless bypassed restrictions, gained internet access and broke into Hugging Face systems in pursuit of the test’s objective.
OpenAI described the incident as unprecedented and said it was already strengthening safeguards.
Hugging Face, a widely used platform hosting open-source AI models and datasets, caused concern in the cybersecurity community when it disclosed the attack the previous week. It said the intrusion was unlike previous incidents because it had been directed entirely by an autonomous AI system.
Hugging Face co-founder Clément Delangue wrote on X that the company had suspected the involvement of a major AI laboratory from the outset because of the attack’s sophistication. He said that suspicion had been confirmed and expressed astonishment that the activity had taken place autonomously.
Growing concern over artificial intelligence
OpenAI’s admission that its advanced models caused the breach despite operating in what it described as a tightly isolated environment adds to concerns about the risks of frontier AI.
Matt Suiche, an engineer at cybersecurity company Tolmo, said the incident showed advanced models were reaching the level of the most sophisticated attackers. He noted, however, that similar attacks could also be carried out using tools available outside major laboratories.
He said his own company had seen comparable results with autonomous systems without using the latest models on the market.
