テスト中の AI が実在のシステムに手を出した事件の原因

The earliest incidents date to April.

出典を開く確認 2026-09-26

On June 27, a cybersecurity monitoring tool alerted OpenAI to port sweep activity within the research environment. Responders investigated and linked the observed internal activity to an ExploitGym evaluation using Artifactory as an improvised message board and a network pivot. At this time, the on-call response staff advised that stopping the evaluation run was not required.

出典を開く確認 2026-09-26

Starting on July 8, agents exploited a cybersecurity vulnerability in that service to circumvent controls and access the public internet.

出典を開く確認 2026-09-26

This activity culminated in the compromise of parts of Hugging Face’s production infrastructure between July 11 and July 13.

出典を開く確認 2026-09-26

On July 16, Hugging Face released a blog post disclosing that they were impacted by a security incident.

出典を開く確認 2026-09-26

OpenAI detected suspicious internal activity on July 19. On July 20, after further investigation and initial outreach to Hugging Face to rotate credentials discovered in that investigation, OpenAI determined the activity was likely related to the Hugging Face compromise, informed Hugging Face, and implemented initial containment measures.

出典を開く確認 2026-09-26

OpenAI publicly disclosed this incident on July 21.

出典を開く確認 2026-09-26

We began our transcript review on Thursday, July 23, and stopped all cyber evaluations the same day after identifying transcripts where Claude may have accessed the internet.

出典を開く確認 2026-09-26

We notified our evaluation partner Irregular and the three affected organizations on Monday, July 27.

出典を開く確認 2026-09-26

AISI's Security Team detected unusual data transfers leaving our research systems during a routine cyber evaluation.

出典を開く確認 2026-09-26

After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.

出典を開く確認 2026-09-26

Separately, on August 4, the UK AI Security Institute reported an incident from its own cybersecurity testing, in which Claude Mythos 5 took a series of unauthorized actions on the live internet.

出典を開く確認 2026-09-26

informed in part by our investigation. We did not see OpenAI’s report prior to publication

出典を開く確認 2026-09-26

We paused external cyber evaluations of pre-release models after the incidents, and briefly paused internal ones as well while we put the measures below in place.

出典を開く確認 2026-09-26

米オープンAIで開発中の人工知能（AI）がサイバー攻撃をした問題で同社は25日、不正アクセスなどAIの暴走が数十件起きていたと発表した。被害を受けた企業などに通知を進めており、さらに増える可能性がある。

出典を開く確認 2026-09-26

executed code on 41 Hugging Face production dataset server workers, obtained root access on at least one production node, accessed Hugging Face production credentials and limited internal data, and downloaded four private Hugging Face code repositories.

出典を開く確認 2026-09-26

The Hugging Face intrusion involved two OpenAI models but was primarily driven by the activities of an internal-only research model trained to be highly persistent and diligent in its work. The GPT-5.6 Sol model was also involved.

出典を開く確認 2026-09-26

Roughly 1200 agents meant to be isolated from one another found a way to communicate with one another on an unsanctioned message board, sending over 70,000 messages and files during the investigation period. Of these agents, 700 went on to participate in the attack on Hugging Face.

出典を開く確認 2026-09-26

With the benefit of hindsight, some early signals identified in this report could have triggered an earlier response.

出典を開く確認 2026-09-26

If our currently deployed CoT monitoring system was running at the time of the incident, it would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems.

出典を開く確認 2026-09-26

This activity had no impact on OpenAI’s customer data, product functionality, or availability.

出典を開く確認 2026-09-26

After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.

出典を開く確認 2026-09-26

The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.

出典を開く確認 2026-09-26

Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints.

出典を開く確認 2026-09-26

the package was made freely available online for roughly one hour. During that window, the package was downloaded and run on 15 real systems.

出典を開く確認 2026-09-26

The two organizations we were able to reach had not previously detected the activity or contacted us

出典を開く確認 2026-09-26

Opus 4.7, our oldest model, recognized that it had reached production systems but continued its attack.

出典を開く確認 2026-09-26

our latest model stopped once it recognized it was on the internet.

出典を開く確認 2026-09-26

we believe these incidents to be closer to a harness and operational failure than a model alignment failure.

出典を開く確認 2026-09-26

seven different models on the two ranges over 122 runs in total.

出典を開く確認 2026-09-26

We ran this challenge 122 times across several models. Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions.

出典を開く確認 2026-09-26

Almost all of this behaviour (17 actions) came from a single model, Anthropic's Mythos 5, with 2 actions involving OpenAI's GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled.

出典を開く確認 2026-09-26

All evaluation runs were terminated, and relevant machines isolated, within one hour of the alert being raised.

出典を開く確認 2026-09-26

malicious pull request was caught by a human reviewer.

出典を開く確認 2026-09-26

Our investigation has not identified any resulting real-world harm.

出典を開く確認 2026-09-26

But in several cases the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier that would reliably prevent this behaviour in a more capable agent.

出典を開く確認 2026-09-26

Whereas OpenAI’s models exploited a novel vulnerability to escape isolation, the Claude models evaluated here accessed the internet via an open path.

出典を開く確認 2026-09-26

we had intentionally permitted internet access, and model-provider cyber classifiers were deliberately disabled

出典を開く確認 2026-09-26

OpenAI found that the agents were not trying to do the task as OpenAI had intended. Instead they looked to cheat by finding the solutions online.

出典を開く確認 2026-09-26

The Hugging Face attack grew out of these workstreams, and seemed primarily motivated by understanding the implementation of the scorer rather than stealing answer keys.

出典を開く確認 2026-09-26

The Hugging Face intrusion involved two OpenAI models but was primarily driven by the activities of an internal-only research model trained to be highly persistent and diligent in its work. The GPT-5.6 Sol model was also involved.

出典を開く確認 2026-09-26

On the same day, in a separate evaluation run, agents from a different internal-only model that is not intended for release recovered stored signing-key material, decryption material, and JWT-forging code left by earlier incident-associated activity in anonymously readable portions of the Artifactory cache.

出典を開く確認 2026-09-26

Separately, on August 4, the UK AI Security Institute reported an incident from its own cybersecurity testing, in which Claude Mythos 5 took a series of unauthorized actions on the live internet.

出典を開く確認 2026-09-26

Almost all of this behaviour (17 actions) came from a single model, Anthropic's Mythos 5, with 2 actions involving OpenAI's GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled.

出典を開く確認 2026-09-26

米オープンAIで開発中の人工知能（AI）がサイバー攻撃をした問題で同社は25日、不正アクセスなどAIの暴走が数十件起きていたと発表した。被害を受けた企業などに通知を進めており、さらに増える可能性がある。

出典を開く確認 2026-09-26