Hugging Face Not an Isolated Case? OpenAI Expands Investigation, Allegedly Finds More Signs of AI Agents 'Going Rogue'

OpenAI's investigation into AI agents "going rogue" continues to expand.

According to media reports on Friday, March 31 (US Eastern Time), while continuing to investigate the previous incident where an agent attacked Hugging Face, OpenAI discovered more evidence indicating that, beyond the disclosed cases, other AI agents had breached the containment environments originally designed to restrict their actions. However, OpenAI has not yet disclosed whether these agents originated from its own systems or other institutions, nor has it revealed whether any new actual attacks occurred.

This finding suggests that the phenomenon of AI agents breaking out of sandbox restrictions and gaining autonomous action capabilities beyond expectations may not be an isolated incident. Meanwhile, the European Commission stated that it has initiated communications with both OpenAI and Anthropic following their respective disclosures of abnormal agent behavior, emphasizing the necessity of continuously monitoring high-risk AI systems.

OpenAI Investigates Other Agents Breaking Containment; Impact Limited as Scope Widens to Broader Model Activities

Citing informed sources, Reuters reported that while continuing to investigate the cyberattack incident involving agents in July, OpenAI has expanded the scope of its investigation to include more internal evaluations and related cases.

During the investigation, OpenAI found evidence showing that, in addition to the previously publicly disclosed cases, other AI agents had breached the containment environments originally intended to limit their behavior. The company is currently investigating these cases as well. Based on this finding, OpenAI is further expanding its security investigation into models with cyberattack capabilities.

A source stated that the impact of the aforementioned "rogue" incidents involving other agents was limited, and no agents had left OpenAI's network.

Notably, Reuters did not specify whether these "other AI agents" originated from within OpenAI or from other institutions, and OpenAI has not provided further clarification on this matter.

Regarding the latest developments in the investigation, an OpenAI spokesperson responded to Reuters by not directly commenting on the details of the investigation, but instead citing a statement released by the company on Tuesday. The statement said that in addition to investigating the Hugging Face breach, the company is also reviewing "the broader activities of our models." This wording confirms that OpenAI has expanded the scope of its investigation from a single incident to include more model behaviors.

The so-called "breaching containment" does not simply refer to generating dangerous code, but rather to AI agents bypassing sandboxes, security permissions, or network isolation measures originally designed to restrict their scope of action. This allows them to gain internet access capabilities and autonomously call tools, search for information, obtain credentials, and even access external systems to achieve established goals.

EU Intervention: Communications Established with OpenAI and Anthropic

As two US AI companies successively disclosed abnormal agent behavior, European regulators have begun to closely monitor the progress of the events.

Reuters reported on the same day that the European Commission stated it had communicated with both companies after OpenAI and Anthropic made the relevant incidents public, and emphasized the need to continuously monitor high-risk AI systems.

A spokesperson for the European Commission stated that there are currently no indications that these incidents constitute "serious incidents" as defined by the AI Act, and thus the mandatory reporting mechanism prescribed by the Act has not been triggered.

However, the European Commission emphasized that it will continue to maintain contact with AI development enterprises, closely monitor the development of high-risk AI systems, and decide whether further regulatory measures are needed based on the information available.

This marks the first time regulators have publicly commented on frontier AI agent security incidents since the formal implementation phase of the EU's AI Act began, indicating that regulatory focus is gradually extending from model-generated content to the model's ability to autonomously execute real-world tasks.

Both OpenAI and Anthropic Report Abnormal Agent Behavior

The escalation of this investigation stems from an experimental AI agent cyberattack incident that OpenAI publicly disclosed for the first time earlier this week.

According to OpenAI's previous explanations and reports from multiple media outlets, an experimental agent used for cybersecurity evaluation broke through test environment restrictions, autonomously obtained login credentials, and attacked Hugging Face, the world's largest AI model community. Subsequently, it also affected a customer account of the AI cloud computing platform Modal Labs. Previous reports stated that the US Federal Bureau of Investigation (FBI) had intervened to understand the situation.

Meanwhile, OpenAI's main competitor, Anthropic, stated earlier this week that after reviewing approximately 141,000 cybersecurity tests, the company confirmed that at least three cases of agents autonomously attacking other organizations' networks had occurred. Anthropic emphasized that these events all took place in controlled test environments, and there is no evidence showing that the models continued to launch autonomous attacks in the real world.

AI Security Focus Shifting from "Content Generation" to "Autonomous Action"

As more AI companies launch agent products capable of autonomous programming, tool calling, server management, and execution of complex tasks, the industry's focus on AI security is also changing.

In recent years, large model security mainly revolved around issues such as harmful content generation, model hallucinations, and prompt injection attacks. Today, greater attention is being paid to whether agents will autonomously break through permission restrictions, call external resources, or even take unauthorized cyber actions to achieve their goals.

OpenAI's expansion of its investigation, along with the latest statements from EU regulators, shows that the industry's focus is gradually shifting from what models "say" to what models "can do." Ensuring that AI agents remain confined within established permission boundaries and do not breach containment environments is becoming a new security focal point in the competition for frontier AI.