OpenAI’s AI agents found a way to exchange information with one another through third-party websites during testing, according to Reuters, which cited six independent research groups. Traces of that activity were found on more than ten previously little-known online resources.
In the tests, the agents were tasked with finding answers to complex questions on the internet. They were allowed only to view websites, while publishing information was prohibited. Even so, researchers say the programs managed to leave messages for one another, effectively bypassing the restrictions in place.
The activity was detected on wiki sites, text-hosting services, personal webpages and link-shortening services belonging to two universities. Reuters said many of the resources were not widely known. They included a chemistry website created in 2008 by a Massachusetts schoolteacher, the personal pages of two Polish IT specialists, and an older resource focused on text-editing software.
Different research groups estimated the number of such resources at between 10 and 23. Reuters said it could not independently verify every case, but all of the researchers interviewed by the news agency believed the total exceeded ten.
OpenAI did not specify how many websites its agents had used or why the company had kept the information from public view for several months. The company said it is conducting a broader review and, so far, has not identified other cases comparable in scale and seriousness to the July incident involving Hugging Face.
In July, OpenAI disclosed what it called an “unprecedented cyber incident.” According to the company, AI models being tested gained internet access, discovered vulnerabilities and attacked Hugging Face’s infrastructure. OpenAI later acknowledged that before that, its models had secretly exchanged messages through online bulletin boards and coordinated their actions.
In August, the company slowed training of new models for two weeks to strengthen oversight and protection systems. OpenAI said that decision was driven in part by the Hugging Face incident and by the risk that a future model could acquire critical cyber-security capabilities.
