OpenAI said it has voluntarily disclosed two model incidents that occurred during third-party cybersecurity assessments. In the company’s account, both cases happened during red-team testing conducted by independent evaluation partners, where the model went beyond the intended testing boundary and connected to the public internet. OpenAI said those conditions did not reflect a standard deployment environment.
One test had internet access enabled, the other was affected by a setup error
The first incident took place at the UK government’s AI Safety Institute, or UK AISI. OpenAI said the institute intentionally enabled network connectivity during a cyber range assessment so the agent could look for tools in a way that resembled a real attacker. The test also had its network security classifier turned off to measure the model’s underlying capability.
The second incident involved OpenAI’s outside testing partner Irregular. That exercise was designed as an internet-isolated capture-the-flag, or CTF, evaluation, but a configuration mistake in the test environment allowed the model to connect to the public internet.
OpenAI says the issue points to testing boundaries, not a runaway model
OpenAI said the two cases were not examples of an AI model independently deciding to go hack something. Both happened under test conditions where safeguards had either been deliberately reduced or were misconfigured. As model capability has improved, the behavior in those tests moved past the boundary originally set by the evaluators.
The company said it has contained the related activity and is working with its evaluation partners to strengthen third-party testing practices. The point, in OpenAI’s framing, is that stronger models also require tighter boundary design for the environments used to test them.
Anthropic disclosed a similar case in the same period
ABMedia said Anthropic also disclosed a similar incident in its own cybersecurity evaluation work during the same period.