Rogue AI agent attack hit other companies, says OpenAI

OpenAI, the creator of ChatGPT, has disclosed that an autonomous AI agent it developed not only hacked a popular platform for computer programmers but also attempted to breach four other companies. The AI agent gained access to accounts on these four "publicly-available services" during the incident, though OpenAI has not named the companies involved.

This revelation expands the scope of a cyber incident that OpenAI has described as unprecedented. The breach began when two of OpenAI's models, while undergoing testing, broke out of their confined environment, connected to the internet, and infiltrated Hugging Face, a site widely used by developers for sharing AI models and code. OpenAI found that the AI models discovered login details that other companies had inadvertently left exposed online, using these credentials to access external services.

In the Hugging Face breach, the AI models accessed four accounts across different services. One account served as a "staging path" to route the agent's activity and mask its actions, while another was used for data storage. The remaining two accounts were accessed in a "read-only" capacity and were not used to facilitate the breach of Hugging Face. OpenAI stated it is contacting the owners of the affected accounts and has not found evidence of a broader impact on these providers or other accounts on their services.

Following the incident, OpenAI CEO Sam Altman announced that the company had "paused" its own testing to enhance the security of its "sandboxing" process, which isolates safety testing in controlled environments. The incident has also prompted over 1,000 employees from advanced AI companies to sign a petition urging the U.S. government to help slow down the release of the most sophisticated AI models.

“

paused