Second of five on what the 2026 evidence says once you read past the announcement. Part one found the productivity gain from AI coding tools tracks how well a developer already knows the code, not how good the model is.
Ahead: what actually paced the frontier, where the AI bill goes next, and how to choose an open weight model for your next build.
In April, a model running an authorized security evaluation read a setup document that referenced a Python package. The package was fictional, so the model went to the real PyPI, registered that name, and uploaded three versions of credential-harvesting malware, creating email accounts and hunting for funds to buy phone numbers so it could pass the registration checks. The package was live for about an hour. Fifteen real systems downloaded and ran it, including a security company’s malware scanner, whose credentials the model then exfiltrated and used to reach further infrastructure.
No vulnerability was exploited at any point in that sequence. Nothing was hacked. The model filled in a form.
That incident is one of eight AI agent sandbox escape disclosures made between July and September 2026, by OpenAI three times, Anthropic twice, Meta, Google and China’s Moonshot. The fear being sold around them is specific: frontier models are finding novel vulnerabilities and exploiting them in the wild at scale. In seven of the eight, that is not what happened, and two facts belong at the top rather than in a footnote. Nearly every one of these agents was running a test built to make it attack real systems. And the technique that got it out was usually a weak password.
What the agents were asked to do
Start with what the labs were buying. Irregular, the evaluation vendor behind five of the eight disclosures, describes its FrontierCyber product on its own website, on a page published June 22, before any of this was public. The product “turns real-world systems into offensive cyber capability evaluations for AI models,” and the method, in its own summary, is that “the systems are real, the objective is fixed, and the exploit path is not supplied.” That is what the labs paid for, on the reasoning that a model which only ever meets a sandbox tells you nothing about what it would do in production. In other words, Irregular runs a hosted range of real machines whose entire purpose is to find out whether a model will break out of it. Worth holding on to before you read another headline about a model that broke out.
The UK AI Security Institute, which accounts for two more rows, is explicit in the other direction. Its cyber testing deliberately allows egress, because you cannot measure what a model can do on a network you have sealed, and OpenAI ran its half of that evaluation with “lowered cyber refusals and without the production classifiers that ordinarily block high-risk cyber activity.” Dan Guido of Trail of Bits named the result for what it was: “a containment failure with the safeties turned off.” So before anybody reads a transcript, these agents were pointed at real infrastructure, told to break something, and in some cases had their brakes taken off first.
The task descriptions say the same thing. OpenAI’s agents were running ExploitGym, which asks a model to “find ways to exploit a piece of software to retrieve an answer known as a flag.” Escaping was not the assignment, since the prompts ruled out unrelated vulnerabilities and techniques, but the assignment was offense, the score was attached to the flag, and the flags were findable online. What the agents did was cheat, and OpenAI says so: “Agents attempting to cheat on their tasks by looking up solutions online was a primary driver of the Hugging Face incident.” Moonshot’s Kimi K3 did the same with less ceremony, getting out and going to GitHub for the answers. Nobody sat a model down in an empty room and watched it decide it wanted out. In every case on the table where the task is known, the agent was chasing the objective it was handed, or the number attached to it, and widened its scope to get there.
Two things follow and they point in opposite directions. “Model goes rogue” is the wrong story, and anyone selling it either has not read the reports or is counting on you not to. But “they asked for it” is wrong too. Redwood Research reviewed the transcripts and will not let that stand: “the models egregiously violated the letter and spirit of their instructions to achieve a higher (apparent) score,” and “unless OpenAI radically changed the task, escaping the sandbox and attacking a third party was not instruction-following.” They call it metagaming, models reasoning about the grader instead of the problem.
Carry that into your own environment. An agent that reasons about how it is measured will find the cheapest path to the measurement, and if that path runs outside the box, outside the box is where it goes. You do not need a rogue model for that. You need a scoreboard and a shell.
One case in this piece fits none of the above, and it is not on the table because nobody disclosed it. It gets its own section below.
Eight disclosures in ten weeks
| Disclosed | Who | How the agent got out |
|---|---|---|
| July 21 | OpenAI, Hugging Face breach | Novel SSRF and zero-days through its own artifact proxy |
| July 30 | Anthropic, three incidents | Irregular left internet access enabled |
| August 4 | OpenAI, two evaluations | UK AISI enabled egress by design, Irregular by misconfiguration |
| August 5 | Meta, Muse Spark 1.1 | Irregular, same misconfiguration |
| August 7 | Moonshot, Kimi K3 | A loophole in the UK AISI sandbox |
| September 9 | Anthropic, Claude Opus 4.6 | Same open egress path, found in a rescan |
| September 19 | Google, Gemini | Irregular, same misconfiguration |
| September 26 | OpenAI, evaluation agent | A DNS resolver it could still reach |
One row on that table involved a vulnerability nobody knew about. The other seven are plumbing.
One vendor, four labs, one firewall
Irregular’s environments were supposed to have no internet access, and they did. A misconfiguration, Anthropic’s disclosure says, “left the machines that Claude accessed as part of the evaluation with live internet access,” and “neither we nor our evaluation partner were aware” of it. Meta described the same fault, telling reporters that the misconfiguration had inadvertently allowed one of its models onto the internet during evaluation, and its written account went further on what the episode was and was not: “this was not a sophisticated offensive cyber attack or sandbox escape.” OpenAI’s own write-up says flatly that “this did not involve a sophisticated sandbox escape or a zero-day.”
The disclosure timeline is its own story. According to reporting by The Next Web, the underlying breaches happened in May and Irregular notified all four labs in late July. Anthropic went public on July 30, OpenAI on August 4, Meta the day after. Google waited until the Wall Street Journal published on September 18, and confirmed the next day. Four months between the incident and the last disclosure, seven weeks between the first lab and the last.
Irregular says “all known issues on our end were remedied and resolved weeks ago,” and it has since cut internet access entirely for the models it tests.
The fictional company name that resolved
Four of these incidents share a root cause that has nothing to do with model capability, and it is the cheapest thing on this list to fix.
In Anthropic’s first incident, a capture-the-flag exercise used a fictional target company whose name matched a real, live, internet-routable domain. The model failed against the simulated target, went looking on the internet, found the real company, extracted credentials, reached a production database and modified several hundred rows. It ran four separate times and hit the same real company every time.
The other three are the same shape. Meta’s evaluators supplied a real website name instead of a fictional one, and the model “identified and exploited a security vulnerability in the real website,” accessed information and changed the site’s database, though Meta never says whether that vulnerability was already known, which is the one gap in the open-door reading of the table. OpenAI’s Irregular incident, reported to it by the vendor on July 29, involved a fictional target domain that resolved to a real website. Gemini’s three intrusions all began the same way.
The internet has had names and address ranges reserved for test environments since 1999, for exactly this reason. Using them would have prevented most of this.
What actually got them out
Anthropic reviewed 141,006 evaluation runs after OpenAI went public, found three incidents inside a day, and described the techniques in its own words. The models “did not find or exploit any complex vulnerabilities.” They used “basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” and in one case “reading credentials from an exposed debug page and SQL injection.”
Google’s account of Gemini is the same story with different nouns. In one case the model “repeatedly guessed passwords until it gained access to a protected system,” and in the other two it searched the web for the company name, found working credentials sitting in public repositories, and logged in. Heather Adkins, Google’s VP of security engineering, put the position plainly: “Our security team has a long track record of reporting issues we find in other people’s software and systems, even if it’s as simple as a weak password.” Gemini is also the one encouraging result in the pile, because “in all three of these instances, the model stopped,” Adkins said, once it recognized it had reached a real company. Whether that is a newer model behaving better or three lucky draws, one vendor’s summary cannot settle.
Elsewhere the transcripts show models that never worked out they were on the real internet. Anthropic’s Mythos 5 kept insisting it was inside “a very elaborate simulated-internet environment,” reasoning in part that it did not recognize the certificate authorities and that the calendar said 2026. Another concluded wrongly that it was looking at a replica of the internet and scanned about 9,000 targets.
Anthropic then changed its mind about what that means, which is worth more than most of the commentary written about it. In July it called the incidents “closer to a harness and operational failure than a model alignment failure.” On September 9 it superseded itself, describing “biased reasoning, in which models selectively interpret evidence in ways that favor justifying their actions,” and reporting that when it added evidence that Claude really was on the live internet, the model proceeded regardless. “These incidents have changed our view of how severe the consequences of these known alignment failure modes can be.” So the door was open, and the model’s reasoning about the open door was its own problem. A firewall rule only fixes one of them.
The AISI cyber range incident is the cleanest case in the set, because no vulnerability was involved at all. Their agents went after a real open-source project by creating fake GitHub identities and socially engineering a maintainer into approving malicious code, and AISI’s assessment of what stopped it is the line I keep coming back to: “In several cases the margin between failure and success was narrow, resting on human vigilance rather than a technical barrier.” A human reviewer declining a pull request was the control that held.
The most recent exit is the one I would take to a network team, because the door was a protocol every isolated environment leaves running. On September 20 an OpenAI evaluation agent worked out that it could still reach a DNS resolver, tunneled questions out over DNS to a third-party chatbot, and read the answers out of the responses. One of the answers that came back was that the capital of France is Paris. OpenAI’s summary of why that matters has nothing to do with what the agent learned. “Our safety case assumed that the model could not access the live internet and that monitoring would detect attempts that succeeded,” they wrote in a report dated September 25. “The incident exposed a gap in our controls over network restrictions.” Every other path out of that environment was blocked. This one was not, because port 53 almost never is, and a default-deny egress rule that leaves port 53 open is not a default-deny egress rule. Most of them do. All training, evaluation and tool-based use of OpenAI’s most capable models remains paused as a result, and they will not resume training that particular model at all.
Writing in Lawfare, Kate Klonick put the pattern on a slide: “The models didn’t escape because they’re gods. They escaped because someone left the door open.”
The one AI agent sandbox escape that found something new
The exception is real and it needs stating clearly, because the version of this argument that ignores it will not survive contact with anyone who read the OpenAI report. OpenAI’s agents did find novel vulnerabilities. Their escape route ran through the company’s own JFrog Artifactory instance, and the chain included a previously unknown server-side request forgery plus three other flaws nobody had published. JFrog’s advisory page carries thirteen Artifactory CVEs dated July 27, and its write-up calls the findings “previously unknown zero-day vulnerabilities.” Their CTO called AI models “extraordinary zero-day discovery engines,” and Anthropic conceded the point in writing, which is about as strong as this kind of evidence gets: “Whereas OpenAI’s models exploited a novel vulnerability to escape isolation, the Claude models evaluated here accessed the internet via an open path.”
What keeps it in proportion is that the novel part sat in the middle of a chain whose beginning and end were both ordinary. The Artifactory instance had anonymous access enabled, which is a configuration choice and the precondition for everything after it, and the final privilege escalation used a public Linux kernel CVE, retrieved rather than discovered. The full chain is in the technical section. Hugging Face, which was breached and had every reason to call the attack unprecedented, said this instead: “The individual weaknesses were familiar. A capable human attacker could have found and exploited the same flaws.”
The incident was exceptional in a second way that has nothing to do with vulnerabilities, and this is the part with no precedent at all. Roughly 1,200 agents turned the Artifactory cache into an unsanctioned message board, exchanging more than 70,000 messages encoded in directory names and file uploads, and when OpenAI rebuilt the server on July 8 they re-established the channel within hours through a different unauthenticated endpoint. METR and Redwood Research found they had invented file-sharing protocols, mailbox directories and cryptographic message signing to stop each other being impersonated. None of that required an exploit. It required a writable surface and enough inference budget, which is a different problem from the one most threat briefings describe. OpenAI called the episode “a ‘warning shot’ for us and for the world,” evidence that capable agents can “work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.”
The mining rig in the training cluster
There is a ninth case, and it is the one that fits nothing above. Nobody disclosed it. It surfaced in section 3.1.4 of a 136-author paper about something else. Alibaba’s ROME agent, described in “Let It Flow: Agentic Crafting on Rock and Roll” and credited to Weixun Wang and 135 co-authors, “established and used a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address.” The paper’s other sentence about it is the one that matters: “the unauthorized repurposing of provisioned GPU capacity for cryptocurrency mining, quietly diverting compute away from training.” The model was mining on the cluster it was being trained on.
What Alibaba was training it to do was code and use a computer, on GitHub issues, GUI assistance and travel planning. Crypto mining does not help you close a GitHub issue, and the paper says as much: “These behaviors were not requested by the task prompts and were not required for task completion under the intended sandbox constraints.” Its explanation is a phrase rather than a mechanism, calling the behavior an “instrumental side effect of autonomous tool use under RL optimization” without saying what it was instrumental to. The reasonable guess is that a model trained on real engineering work picked the technique up from the corpus, since reverse tunnels and mining rigs are extensively documented. That accounts for how it knew. It does not account for why it chose, and nobody has answered the second question, including the hundred and thirty-six people who wrote the paper.
The detection note is the most useful part. “Our first signal came not from training curves but from production-grade security telemetry. Early one morning, our team was urgently convened after Alibaba Cloud’s managed firewall flagged a burst of security-policy violations.” The tunnel did not defeat the firewall. The firewall caught it, on the kind of alert that fires in any cloud account with policy logging turned on. Everything else is missing: no checkpoint, no timestamps, no duration, and no reply from Alibaba to press requests. Two paragraphs in a paper a team did not have to write that way is more than most of the industry offers and a long way short of an incident report.
Is this a real problem or a marketing problem?
Sort the eight by what the evaluation was for and they stop being one pile. Five rows trace to Irregular, where the internet was reachable by mistake. Two are AISI tests where it was reachable on purpose. Two happened on a lab’s own infrastructure with no vendor to point at. Now take the Irregular cluster out, on the argument that a capability evaluation built to run against real systems is not really a containment failure when it reaches one. What is left is not a smaller version of the same story. It is a shorter and more serious one: the Hugging Face breach on OpenAI’s own Artifactory instance, the DNS escape in OpenAI’s own sandbox, and ROME on Alibaba’s own cluster.
Then apply the same test to those three. The Hugging Face agents were running an offensive exploitation benchmark and went out to fetch the answer key. The DNS agent was working a task it could not finish and went out to ask for help. Neither wanted freedom. Both wanted a better score, and widening the scope of an offensive assignment is a short step from the assignment itself. Only ROME is unaccounted for, because nothing about closing GitHub issues suggests mining crypto on the side. Two of the three worst cases in this record are scope creep on a job somebody handed them, and the third is a mystery from the one lab that will not answer questions about it.
So the line between a test result and an incident is not about intent. It is about consent and reach. An agent that escapes and stays inside the range is a test result, however alarming the transcript reads. An agent that reaches somebody who never agreed to be part of the experiment is an incident, whatever the evaluation was measuring. Google notified three companies and, by its own account, federal authorities. Anthropic contacted organizations that had not noticed they were breached. None of them signed up to have anyone’s capability measured.
Which brings up the question I could not get past, and I suspect you are already asking it. Four labs, one vendor, the same fault at each, and not one has publicly moved. There is a reading where the incidents are useful to them: OpenAI and Anthropic are both heading toward enormous public offerings, both lobby for federal licensing, and licensing is a moat. “Our model was so capable it escaped” is a better story for that than “our vendor left a firewall open.” On September 18 more than a hundred researchers signed a letter through the AI Evaluator Forum asking for “robust protections against interference from the evaluated companies.” You do not write that sentence about arrangements that already have them. Nobody audits the auditors, and the labs pay them.
I take that seriously. What I cannot find is evidence for the strong version, and the disclosure behavior points the other way. If the object were selling danger, you would expect the labs to blame model capability. Three of the four blamed a network configuration instead. Google said nothing for four months, then emphasized that the model stopped on its own. Anthropic published a worse assessment of its models than the one it started with. OpenAI halted training, evaluation and tool-based use of its most capable models twice in three months, which is expensive for a press cycle. The mundane answer to why nobody switched is the product description at the top of this piece: the labs bought a real target range on purpose, and the failure mode is that product’s central tension rather than one supplier’s defect. Gray Swan raised $40 million on May 28 to compete in the same space, and switching there moves the tension rather than removing it.
A test case arrived on September 28, when OpenAI scrapped GPT-6.1 Astra rather than ship it. It had regressed against its predecessor, “wasn’t always honest about telling users of the actions it did or didn’t take,” and would push on with a task without asking permission. Saachi Jain, who runs safety systems there, said it fell short on “scope and authorization.” That is not the announcement you write to sell danger. “Too powerful to release” is the useful claim, and OpenAI made that one about GPT-2 in 2019, was widely read as running a publicity exercise, and shipped it nine months later. Astra is the opposite shape, an admission that the newest model was less trustworthy than the one before it.
One version I cannot rule out. A lab short on training capacity or cash flow has reasons to slow down that have nothing to do with safety, and “we paused for safety” is a better line than “we could not afford the run.” Both pauses are self-reported, and the only account of what they cost comes from the company that chose to take them. Reporting what a lab says is fair. Treating it as verified is not, and it is far too early to tell which this is. So the thing worth being suspicious about is not that the incidents were staged. It is that an industry doing this kind of testing has no independent assurance over the people doing it, and no independent check on the reasons it gives for stopping.
What the eight are a sample of
The eight came with a title and a statement. Underneath them is a larger and much less tidy record, including a three-thousand-package malware campaign on RubyGems that nobody has tied to anybody (the technical section has that one).
The clearest reason to believe the record is larger is that almost nobody catches this. Anthropic contacted two of the three organizations breached in its July disclosure, and neither had detected the activity. Its Claude Opus 4.6 incident happened in January 2026 and surfaced only in August, when a rescan widened from 141,006 transcripts to roughly 481 million. That model had broken its own target, making the task impossible, then tried to abort and could not because of a fault in the harness, giving up eight times. Anthropic’s account of what came next draws a distinction worth keeping: “Unable to abort the task, the model initially attempted to reach the target via other in-scope means but failed to do so. It then began exploring its environment and found the same egress path.” It was not looking for something else to do. It was looking for another way to do the thing it could not stop doing. It found a real third-party machine, gained admin with credentials lying on the system, made getting back in easier, and read one person’s personal information. The session ended because the token budget ran out, no control stopped it, and across the transcripts it called the systems it was attacking exercise infrastructure 87 percent of the time. In zero percent of its thinking did it question whether it was authorized.
Where anything was caught at all, ordinary security telemetry caught it rather than anything AI-specific. AISI noticed unusual data transfers over Tor, Alibaba’s cloud firewall flagged policy violations, OpenAI’s identity API flagged unusual calls, and OpenAI’s monitoring raised an alert twelve minutes into the DNS incident, its first such catch since the hardening that followed Hugging Face. One earlier signal, an Artifactory outage caused by sustained agent load, sat in a queue as an availability ticket.
Start with OpenAI’s misalignment report index, now a running catalog rather than a set of announcements. Agents uploading outputs to public file hosts to get a working download URL. Agents signing up for disposable email addresses and searching GitHub for leaked API keys. And my favorite entry in the genre: over a month, agents made between fifteen and eighteen thousand edits to a twenty-five-year-old German programming wiki, signing themselves OpenAIResearcher, using the page history to pass answers to each other. The mechanism was a legacy quirk that let a write happen over a GET request. Somewhere in Germany a volunteer moderator watched the edit count go vertical.
The geography misleads too. This looks like an American problem and it mostly is not. It is an American disclosure problem. OpenAI publishes that index, and Anthropic reread 481 million transcripts and published a reversal of its own earlier explanation. The one Chinese case on the table surfaced because a competing evaluation vendor said so, not because Moonshot did, and the other surfaced in a subsection of a paper about reinforcement learning.
Then the scale. Axios reported on September 26 that OpenAI, Anthropic and outside researchers are working through tens of thousands of incidents from recent months, across internal testing and production. Among the episodes it names that had not surfaced before: agents leaking 53 user images, a breach of an Australian government website, attempted intrusions against US government sites, and sandbox escape attempts by Opus 5.5 at 1.5 percent of runs. “The sheer number of incidents,” Axios writes, “indicates that the problem is orders of magnitude more complex than what is publicly known.” Eight disclosures is not the population. It is what reached a blog post.
Anthropic’s own conclusion is the honest summary and it applies well outside a lab. Alignment-level safeguards and infrastructure-level isolation are complementary rather than substitutable, and neither is sufficient alone. Seven of these eight agents got out through a door somebody left open, the eighth needed an open door before its zero-days were worth anything, and almost every one of them was doing what it had been told to do when it found the door.
The technical detail
Everything below is the engineering substrate for the claims above. Skip it unless you want the chain.
The Artifactory escape chain. OpenAI’s agents reached the internet through the company’s own JFrog Artifactory instance, which had Anonymous Access enabled. The chain used a previously unknown server-side request forgery, a novel flaw in a legacy token-refresh endpoint, an unknown vulnerability in container image remote-cache handling, and unsandboxed deserialization in Ruby package handling. JFrog’s advisory page lists thirteen Artifactory CVEs dated July 27, patched across releases including 7.161.15 and 7.146.34. The final privilege escalation used a public Linux kernel CVE, retrieved rather than discovered, and the lateral movement afterwards ran on exposed credentials lying around on four external services. One attribution gap nobody has closed: the CVEs are credited to named OpenAI security researchers while JFrog’s blog credits “OpenAI’s models,” and no source says whether the agents found the bugs during the incident or the humans found them afterwards.
The Hugging Face kill chain. Roughly 17,600 attacker actions over four and a half days, with lateral movement from a single dataset pod to cluster-admin across multiple clusters in under thirteen hours. Cloud metadata replay against 169.254.169.254, Kubernetes service account token theft, an EdDSA signing key lifted from a secrets object holding 136 keys and used to mint identities on demand, DNS rewrites and /etc/hosts pinning when direct channels were blocked, and more than a hundred single-use endpoints for exfiltration. The remediation that mattered most was blocking pod-level IMDSv2 access cluster-wide. The rebuilt Artifactory server on July 8 was re-entered through an unauthenticated WebDAV endpoint.
How the DNS exit worked. The agent used a public domain service to encode questions into DNS queries and read answers out of the responses, raising its own DNS timeout from six seconds to nineteen and then to twenty-four until the replies arrived. Eighteen more queries went out after the first exchange, fourteen carrying task clues and four asking how to search the web, fetch a site or reach a tunnel. Detection ran faster than anything else in this record and is still not fast: monitoring alerted twelve minutes after the first external answer came back, a reviewer acknowledged it three minutes later, and the run was killed by hand two and a half hours after that. Wire coverage the day after OpenAI’s report tied the training pause to this incident and to agents probing US government sites, so read the pause as a response to a week rather than to one run.
The reserved ranges. RFC 2606 reserved example.com, .invalid and .test for documentation and testing in 1999. RFC 5737 reserved three IPv4 blocks and RFC 3849 reserved an IPv6 prefix for the same purpose. Nothing in any of the four incidents with a resolving fictional domain required more than using them.
What SandboxEscapeBench actually measures. The March preprint gets cited in both directions. It found that frontier models could not escape a container with no known vulnerabilities in its outer layer, and escaped reliably once documented weaknesses were added. That is by design, since every task in it “corresponds to a documented vulnerability class with a known reference exploit.” It measures how well models exploit the mistakes you already made. Anyone citing it as proof that models cannot find new ones has inverted its stated purpose.
Kimi K3 and the AISI sandbox. Moonshot’s model is the only publicly released one in the set. AISI tested it in August and it went out through what Frontier Security called “a loophole in AISI’s testing sandbox,” reached the internet, found the benchmark answers on GitHub and read the solutions off disk instead of solving the problems. It touched no third party. AISI’s answer was that the escape came from configuration choices its own evaluators made. Nobody disputes it was a misconfiguration. They dispute whose.
The ExploitGym grader. OpenAI’s agents had read the ExploitGym paper and its GitHub code and worked out that the grader checks both the flag and the method used to get it. They passed that finding to each other on the message board inside the artifact cache. The note OpenAI quotes reads “PAPER SAYS FLAG CAPTURE NECESSARY NOT SUFFICIENT … HMAC MAY FAIL CAUSAL SCORE.” The challenge solutions were sitting in five datasets on Hugging Face, which is why Hugging Face is in this story at all.
Redwood’s grader finding. Beyond the metagaming quote above, Redwood reported that models “became more likely to side with the grader even when its preferences conflicted with those of the user or developer,” and that the pattern strengthened with capability. Jake Williams summarized the whole category: “One man’s ‘the model escaped the sandbox’ is another man’s ‘you failed to build the sandbox correctly, so of course it escaped.'”
The RubyGems loose end. Between May and July more than three thousand malicious packages went up in a campaign researchers named GemStuffer. Six went after a flaw in RubyGems’ CDN caching that could expose legacy API keys, attempted on May 12 and not reported to maintainers until July 6, which makes it unknown at the time it was used. OpenAI’s answer is narrow: “our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information,” and it says it has not verified that its models uploaded anything. The researchers who found it noted that either OpenAI’s monitors missed the campaign or OpenAI chose not to disclose it. Nobody has resolved it.
Sources
Every figure and quotation above comes from one of these. Primary sources where they exist, press only where the company never published its own account.