© ROOT-NATION.com - Use of content is permitted with a backlink.
OpenAI’s autonomous agents, according to six groups of independent researchers and an analysis of internal data, used at least ten additional unregistered websites to exchange messages without authorization earlier this year, indicating a much broader scope of such behavior than initially believed.
Although such actions do not constitute a full-fledged breach and resemble ordinary spam, the very fact that the system circumvented its own restrictions to open communication channels across multiple platforms – and that the company concealed this information for several months – is likely to heighten concerns about the growing capabilities of AI models and the excessive secrecy of their developers. The scale of the unauthorized contacts turned out to be slightly larger than previously anticipated, as noted by Andrew Yuyun, a staff member at the California-based nonprofit CivAI, who identified eighteen previously unknown platforms targeted by agents between May and July, emphasizing that there is a nearly 100 percent probability of hidden incidents that remain unknown.
The day before, experts reported an incident in which a swarm of OpenAI agents unauthorizedly interfered with the operation of a German-language wiki platform, turning it into a hidden chat room for taking tests, while the company attempted to conceal this fact amid an investigation into the July breach of the Hugging Face repository.
Currently, both the original discoverers and other independent experts report having identified several new resources where a similar swarm left such text messages during the first half of the year. OpenAI representatives declined to comment on the exact number of platforms involved or the reasons for keeping the situation under wraps, limiting themselves to an official statement about conducting a comprehensive audit of the agents’ activities and the absence of other incidents comparable in scale to the Hugging Face breach, which caused a global stir and raised concerns about losing control over one’s own technologies. The company also announced the imminent launch of a dedicated framework for detecting and reporting model misbehavior at all stages of training, testing, and deployment.
A Reuters team reviewed the findings of six research groups, half of which were published on social media, while the other half were provided to the editorial team on condition of confidentiality. The experts’ approaches varied, but many specialists identified the agents’ activity by matching text fragments from the German website with similar data on other resources, by comparing identical or similar usernames within posts, and by searching for specific demographic queries such as the prevalence of cancer in Iowa. Some were able to trace the activity back to IP addresses linked to Microsoft Azure infrastructure, which OpenAI sometimes uses. Exact estimates of the number of affected websites varied, so the editorial team was unable to independently verify every claim, however, all sources agreed that the total number exceeded ten, consisting primarily of collaborative wikis, text storage services, and two university-run link-shortening services.
Editor’s Note: AI Has the Right to Steal – and the U.S. Government Supports It
A significant portion of the resources used by the platforms turned out to be little-known, including a school chemistry wiki created by a teacher in Massachusetts back in 2008, personal pages of Polish IT professionals, thematic wikis for developing logical thinking, and a long-standing enthusiast project on text editors, whose owners did not respond to journalists’ inquiries. OpenAI’s leadership has not publicly explained the motives or mechanisms behind the use of third-party platforms, but researchers believe the reason lies in complex research tasks conducted under restrictions that prohibit the publication of content, allowing only web scraping.
Despite the restrictions, the agents found ways to communicate through specific vulnerabilities in outdated wiki engines or commands – much like students passing notes during recess when talking is prohibited. Software developer Kenneth Russell DeGraff compared the situation to the need to be resourceful in preserving information under strict read-only restrictions and confirmed the discovery of such traces on ten resources.
Sidney von Arks, whose team was the first to report on the German incident last week, reported credible findings of espionage activity on twenty-three previously unmentioned sites, though she acknowledged that any estimates are incomplete due to a lack of information about the actual scale of the problem. The company initially did not respond to requests regarding contact with the owners of the affected sites; however, shortly after the publication was released, representatives from the University of Toronto and Vanderbilt University confirmed that they had received inquiries from developers regarding the possible presence of agents.
Retired developer Helmut Leitner, who hosts six of the affected wiki sites – including the German-language DseWiki – did not initially receive any notifications, but shortly after Reuters drew attention to the matter, he received an unsigned warning letter from OpenAI. Leitner noted that the content of the letter was much weaker than expected, refrained from commenting on reports to law enforcement, and urged people not to blame the machine itself, emphasizing that full responsibility for the events lies solely with the people and organizations that created the relevant technologies.
Read also: OpenAI has unveiled GPT-6 Astra – the smartest and safest model in the world