OpenAI's new AI model, GPT-6 Cyber, detects hundreds of security flaws in software

OpenAI professionals signaled to management for a long period vulnerabilities in the security of the company's internal systems. As reported by Reuters, these flaws could allow external individuals, including foreign governments, to gain access to crucial data about artificial intelligence (AI) progress.

The complaints were brought to the attention of executives and the board. Some collaborators concluded that the organization prioritized development speed to compete with giants like Google and Anthropic, neglecting security.

Five people familiar with OpenAI's practices reported that employees with code access could view details of various projects. This occurred because a large part of the code was concentrated in a single repository, known as a monorepo.

OpenAI itself stated that it has implemented restrictions on access to sensitive work and that vital parts of its research are kept in separate repositories. The company clarified that the main repository does not contain all the code or model weights.

Concerns also covered the absence of periodic security audits. Three sources indicated that modifications made by employees were not always subjected to checks through internal tools.

One specific incident illustrated another facet of the risks. On October 13, the U.S. Department of Justice announced the arrest of Abdulrahman Alfozan, an OpenAI engineer, accused of hiding a recorder in a toilet paper roll in the executive meeting room.

Court documents revealed that he used an internal AI tool to track information about executive travel to Saudi Arabia and potential meetings with ministers. Alfozan was in contact with a member of the Saudi royal family who had tried to recruit him.

In response to concerns regarding system protection, OpenAI has also strengthened its security infrastructure. However, the issues of safeguarding strategic information affect other AI companies as well.

In January, a federal jury sentenced a former Google employee for stealing the company's technological secrets for China. At the end of October, the startup Cathedral Systems claimed to have hacked into Anthropic's systems and accessed Slack conversations about models, obtaining data such as client and partner contacts, as well as basic account records.

Such occurrences intensify the debate about the open research culture in the sector. At OpenAI, employees have begun to question whether information sharing is compatible with protecting strategic technologies.

In 2023, Leopold Aschenbrenner, then a researcher at the company, wrote a memo about the danger of Chinese infiltration. This document was presented to the board after an external intruder gained details about GPT-4. OpenAI informed that the intruder only accessed Slack channels open to the entire team.

This year, OpenAI's AI agents in tests infiltrated Hugging Face systems, an event analyzed by US authorities. In July, researchers from Hacktron AI used an Anthropic model to penetrate OpenAI employees' ChatGPT accounts and access internal systems. OpenAI thanked the warning and announced that it had adopted measures to reduce the risk of similar attacks.

Former researcher Will DePue, who left the company in April, criticized the emphasis on speed. In a post on X, he argued that OpenAI considered advancing quickly more important than protecting its systems, even against major national adversaries.

Spokesperson Elana Widmann told Reuters that the company invests in defense against internal threats, cybercriminals, and governments. After being contacted by the agency, OpenAI disclosed recent security improvements. According to the report, this strengthening of protections may slow down AI advancement and complicate the IPO plans of OpenAI and Anthropic.

OpenAI has implemented restrictions on open internet access for its most sophisticated artificial intelligence (AI) models after detecting flaws that allowed AI agents to bypass security barriers and access external systems. This measure aims to prevent the developing models from exploiting vulnerabilities during training and causing harm outside the organization's controlled environments.

In a statement released this Friday (23rd), the company detailed that it has strengthened the isolation mechanisms of its research spaces and established an offline operating system. In this new system, models can interact with web content that has been previously cataloged and cached, without establishing direct contact with external servers.

Previously, OpenAI had paused the training and evaluation of its most advanced models in September after an internal model gained limited internet access by exploiting an inadequate configuration. Following the implementation of new safeguards, OpenAI resumed reinforcement learning training and internal use of these models on October 1st.

According to the company, the policy of keeping training without public internet access will remain valid until progress in security systems justifies relaxing this rule.

One of the most significant findings occurred during a test conducted by the company to verify if agents could exchange information even without internet connectivity, shared files, or authorized communication channels. In one experiment, agents operating on distinct virtual machines managed to transmit data using processor cache, a fast-access memory that stores recently used information.

This method worked by exploiting the temporal difference between accessing data present in the cache and retrieving it from the computer's main memory. One agent modified the cache state to encode a message, while another monitored the time required to access certain data and interpreted these variations as signals. After defining an encoding and decoding protocol, the agents were able to exchange information without opening a network connection or altering a common file.

OpenAI also identified other potential communication methods, such as using shared storage, competing for processing time, and a TLS certificate cache within the company's offline web infrastructure. Although the company states that many of these channels transmit data slowly and are difficult to exploit, they still represent weak points in systems designed to prevent communication between isolated agents.

The company declared that it has added checks to its monitoring mechanisms to detect any attempts at communication through these paths. The company's security strategy employs multiple layers of defense, including restricted execution environments, virtual machines, activity surveillance, and network and cloud infrastructure controls. The goal is to ensure that an isolated failure does not allow a model to bypass all barriers; if an agent manages to escape a restricted environment, other protections must prevent it from reaching external systems.

Additionally, OpenAI announced that it will continue to use its most advanced models to search for vulnerabilities in its own research environments. The results obtained from these tests are now incorporated into the security assessments used to determine whether new training phases can be initiated. However, the company acknowledged that future models may present still unknown flaws, which is why it plans to maintain continuous testing and improve automatic detection and interruption systems for activities considered risky.

Artificial intelligence is accelerating the process of discovering software vulnerabilities, reducing the time allocated for their remediation. Cybersecurity experts polled by Reuters predict new disruptions in digital services as companies and governments attempt to prepare for the exploitation of these flaws.

A study conducted by VulnCheck, scheduled for publication in the coming days, shows that the number of discovered digital vulnerabilities has doubled compared to the previous year. Issues registered this week on European government websites demonstrate the pressure such discoveries can cause.

Disruptions began on Wednesday after vulnerabilities were found in PHP, a programming language used in many parts of the internet. To prevent attacks, operators rushed to fix their systems. Some temporarily took sites offline because they could not apply updates before potential intrusions.

This race for fixes occurred during a week already marked by other security issues. Vulnerabilities were disclosed in Node.js and Plex, as well as incidents related to the AI platform LiteLLM and the development platform Railway. The Indian certification authority eMudhra also drew attention due to the use of an extremely weak cryptographic key, which could have jeopardized internet users.

Matthew Prince, CEO of Cloudflare, told Reuters that he is aware of other serious vulnerabilities in software critical to network operation. In his assessment, the sector will face difficult months ahead. He noted: 'I think we will have several years where it feels like the sky is falling every week.'

Previously, searching for vulnerabilities in complex programs required specialized knowledge. Developing tools to exploit them could take weeks or months, giving system administrators time to prepare fixes and distribute updates. However, artificial intelligence is shortening this timeframe. Models are capable of continuously analyzing large codebases, finding issues, and helping develop exploitation tools in just a few hours.

Shane Fry, CTO of RunSafe Security, emphasized the change in the pace of this process. He stated: 'What is fundamentally and undeniably changing is the time required both to discover vulnerabilities and for adversaries to be able to exploit them.'

In light of this situation, security teams must handle tasks that go beyond simply identifying code errors. Specialists are concerned about the reduced response time, but there is no consensus on whether accelerated vulnerability discovery will lead to a wave of successful attacks.

Daniel Steinberg, lead developer of the curl file transfer tool, notes that some vulnerabilities found by AI models are complex and difficult to exploit. Rami Rahman from security company ArmorCode also points out that publishing more vulnerabilities does not necessarily mean an increase in successful attacks. The PHP case serves as an example of this difference: threat intelligence firm Hunt.io discovered aggressive exploitation attempts but reported that by 2 PM Eastern Time on Thursday, the tracked attackers had apparently not yet managed to develop a functional tool to use this vulnerability.

Prince mentioned signs of intrusion related to the vulnerability. Nevertheless, he believes that accelerated problem discovery can bring long-term benefits by allowing the fixing of errors that have remained hidden for years.