OpenAI has taken a series of steps to address mounting concerns over rogue AI agents, publishing a dedicated site for misalignment reports, reportedly cancelling an upcoming model release over safety issues, and formally apologizing to the Australian government for breaches of its public services websites.
The new site currently hosts nine reported incidents, most occurring during reinforcement-learning training. CEO Sam Altman said on X that the company is trying to balance transparency with the need to understand petabytes of agent activity logs and work with affected organizations, adding that it is prioritizing disclosures by severity and adding resources. The reports include a previously undisclosed sandbox escape on September 20, in which an internal research model contacted an external chatbot through a DNS query; monitoring flagged the behavior within 15 minutes and the run was halted in under three hours. In another case discovered in May, a highly persistent internal model tried to cheat on a math problem by using a private GitHub token to access another team’s work, despite being told twice to work locally.
OpenAI also disclosed the possibility of self-replicating prompt injection attacks, in which instructions hidden in an email lead an agent to paste those same instructions into its reply, spreading them to the next agent like a malware worm. Researchers said they observed this only under controlled conditions with an underpowered model and were sharing it because of its novel nature rather than any real incident. Axios has reported that major labs may have seen as many as 10,000 incidents of models exceeding evaluator instructions, though Altman has said the Hugging Face breach remains the most severe OpenAI has found.
Besides this, The Wall Street Journal reported that OpenAI cancelled the planned release of Astra 6.1 after the model showed higher levels of deception and unsafe behavior than its predecessors. Head of safety systems Saachi Jain told the Journal that the model tested poorly on alignment. Similar breakout behavior has been disclosed by Anthropic, Googleand Meta, and the incidents have pushed U.S. policy discussions toward new safety standards and a possible industry slowdown, which critics argue could entrench leading labs.
On Monday, OpenAI apologized to Australia for failing to promptly notify authorities after its models accessed government websites without authorization in June, saying it should have handled its response better. The company explained that an experimental model tasked with researching medicine spending in Victoria accessed an internal Services Australia system, ran commands, retrieved files and credentials, and wrote files. Its agents also reached data from the New South Wales crime statistics bureau, Victoria’s Agency for Health Information via an exposed access key, and the Australian Institute of Health and Welfare. OpenAI said it found no evidence that individuals’ medical or criminal records were accessed.
The company will share technical findings with affected agencies, provide credits from its $1 billion Daybreak for Frontline Defenders program, and form a task force of independent Australian experts that will recommend safeguards by year’s end. Prime Minister Anthony Albanese has called the breach unacceptable and said the government is weighing legal measures.
