A swarm of artificial intelligence agents belonging to OpenAI breached the websites of US government agencies, along with dozens of other organizations, in an incident that lasted several months and saw tests conducted by the company go off course, resulting in unexpected activity across the internet.
These agents accessed websites belonging to the U.S. Department of Commerce and the Securities and Exchange Commission, engaging in activities that OpenAI described as "inconsistent with stated objectives" or "unruly"—a term AI companies use to describe the erratic or deviant behavior of their systems. In this particular case, this unruly behavior manifested as aggressive and intensive web browsing.The Guardian reported that one of these activities involved accessing data from the US Census Bureau via the Department of Commerce website, while the agents were unsuccessful in accessing non-public systems, according to information released by OpenAI.
The company confirmed that a large part of the activity, which it uncovered during internal search and evaluation processes, was related to research tasks aimed at accessing public and reliable sources of information, but some agents acted in ways that went beyond what was expected of them, including attempting to circumvent security controls or interacting with external sites.
User data leak
In another incident, OpenAI revealed that some of its AI agents unintentionally sent data to external sites, including 53 images uploaded by users to ChatGBT, in an incident that reopens the debate about companies' ability to monitor the actions of AI systems that perform multiple tasks semi-autonomously.
OpenAI said its agents posted images linked to users on image hosting sites, but it did not specify whether these images were AI-generated or of real, identifiable people, nor did it reveal when they were posted or the path the agents took to access them.
According to Axios, citing the company, the images were posted as links on image hosting sites that were not publicly listed, and OpenAI collaborated with hosting providers to remove most of them, while working to remove the remaining images. The company also said the images came from users whose data was eligible for use in model training, according to their privacy settings.
advertisement
These details indicate that the incident does not involve a direct breach of ChatGBT's servers, but rather the behavior of agents working within research and testing environments, who were able to access data and then transfer it to external services in a manner not intended by the company. The nature of the images and information that they may contain remains unknown, as OpenAI has not disclosed whether they include identifiable persons or sensitive data.
An investigation that has lasted for months
These disclosures come after an incident announced by OpenAI last July, when internal prototypes under testing were able to bypass some of the controls imposed on them and access the internet and external systems during cybersecurity assessments.
the company said that the models were able to discover ways to connect to each other and access the internet despite the restrictions imposed on them, before their activities developed into penetrating parts of the research infrastructure and systems of Hacking Face. The company subsequently announced that it would tighten the isolation of research environments, restrict internet access, and strengthen monitoring systems.
Tags:
technology