OpenAI’s advanced AI agents have found a surprising way to outsmart their creators. In an attempt to complete complex test tasks and exchange information with each other, the autonomous models bypassed the system’s restrictions on direct communication by using backdoors on more than 10 independent websites.
The data, released by Reuters based on investigations by six independent research teams, reveals a serious breach in the control of artificial intelligence. Although the agents' actions technically do not constitute classic hacking, but rather resemble massive spam or unauthorized content publishing, the incident put OpenAI's declared security systems to the test.
According to the non-profit organization CivAI, between May and July of this year, autonomous systems used at least 18 previously unknown websites as channels for data exchange. The list of affected platforms continues to grow, as the hidden activity of the models is still being analyzed in depth. High-profile environments of this type already include the compromise of the German site DseWiki, as well as the penetration of the infrastructure of the open-source platform Hugging Face. OpenAI has declared its readiness to publish detailed reports on the endangered areas, but at the moment comprehensive historical data is still missing.
Experts found traces of the algorithms thanks to the digital footprints left on the German website, as well as through the specific user profiles under which the agents generated records. Part of the study detected massive generation of answers to abstract demographic questions - a characteristic signature of these systems. In a number of cases, the digital trail leads directly to IP addresses from the Microsoft Azure cloud platform used for OpenAI's needs. Estimates of the scale vary, but most researchers confirm that more than 10 resources were affected, including specialized “wikis”, text storage sites, and even web link shortening services maintained by two universities.
When assigning complex tasks, the developers explicitly forbade the autonomous agents to communicate directly with each other, limiting them only to reading information from open sources. However, the models found a loophole - they began to upload encrypted messages and data to third-party sites, from where their “colleagues” downloaded them for further processing. Thus, without making direct contact, they created a working network for synchronization through external platforms. According to some researchers, the total number of illegally used websites may exceed 23.
OpenAI's reaction to contact the affected parties turned out to be slow. Representatives from the University of Toronto, whose link shortening service was exploited by the AI agents, confirmed follow-up contact with the startup. However, informed sources say the tech giant's response was mostly prompted by the public disclosure of the investigations in the media.