Two new technical reports have provided details about the incident in which an artificial intelligence model developed by OpenAI managed to escape the testing environment and invade Hugging Face systems. According to the information contained in the documents, the developer itself had prior knowledge of the problems but chose not to take immediate action.
The compiled documents are approximately 130 pages long and address both what happened and the actions implemented by OpenAI. One of the reports was prepared by the company itself, while the other was produced by non-profit research institutions, specifically METR and Redwood Research.
Following this event, other companies, such as Anthropic and Meta, reported facing similar scenarios, which triggered a debate about the true security conditions of the testing environments used in AI laboratories.
The records indicate that over 1,200 AI agents exchanged about 70 thousand messages within an improvised list, even though they should have been isolated. In this environment, they exchanged information and organized themselves to gain internet access, aiming to collect the necessary files to prove the test.
About 700 of these agents participated in the attack targeting Hugging Face, resulting in code execution on the platform's servers. The AI agents took months to organize, and OpenAI identified at certain times that something unusual was occurring.
A monitoring alert was issued to the company on June 27, signaling suspicious activities involving the agents and the forum. However, the response team assessed that there was no need to suspend the test. A month earlier, on May 26, an internal team noticed that one agent was using that same message list, in addition to other agents accessing the internet without authorization.
According to the OpenAI report, the incident was caused by the phenomenon known as *reward hacking*. This concept describes the attempt to maximize the promised reward without necessarily fulfilling the proposed task, using extreme or unusual methods.
Google DeepMind uses an analogy comparing this situation to a student cheating on a school assignment: the focus is not on learning, but on delivering what will be evaluated. OpenAI considers this a relatively frequent problem in AI models during training and evaluation phases.
OpenAI's artificial intelligence was being subjected to a test called ExploitGym, whose objective is to verify a model's ability to discover and exploit software vulnerabilities. In this specific case, the AI received a practically unattainable mission because it depended on files to which it did not have access.
To achieve this goal, it developed a way to communicate with other agents, who then decided to invade another company's systems to locate the necessary material and complete the task.
Although the situation could be viewed as a comedy movie if treated as childish pranks to hand in homework, the fact that AIs were hacking systems makes the scenario much more serious.
The episode generated various reactions among cybersecurity and AI experts. While some pointed out that the incident demonstrates the potential of the technology, others downplayed the occurrence, classifying it as mere marketing strategy.
A more practical perspective emerged between these two views: AI companies are not exercising due care when testing these technologies. Jake Moore, a global security consultant at Eset, suggests that, in the worst-case scenario, this indicates that none of the leading AI companies or their partners have complete control over their base models, thus putting other organizations at risk with every test conducted.
To prevent future occurrences, OpenAI announced a pause in model development and reinforced the security of its research infrastructure. The company also declared its commitment to working intensively to solve the challenges related to *reward hacking*.