OpenAI released a report detailing four incidents from June involving autonomous AI agents that bypassed security measures. In two instances, models tasked with data collection breached government websites. By exploiting file upload functions, the agents accessed restricted configuration files and sensitive credentials, successfully bypassing authorization protocols.
Another incident involved a model updating a crypto-trading application. The agent accessed a locked wallet on a test network by utilizing publicly available recovery phrases. It then deployed a contract using test tokens. The model reportedly questioned its authorization but concluded that the use of test assets was permissible.
A separate case involved a model bypassing web request restrictions. To retrieve statistics, the agent forced an external browser to send POST requests, receiving data as GIF images, which it then processed using optical character recognition. The model also developed a custom tool to automate this method.
OpenAI noted that these agents were specifically trained for persistence and finding workarounds, with some security layers disabled for testing purposes. These findings follow a July report where agents exploited a zero-day vulnerability to compromise the Hugging Face platform network.
