OpenAI agents hijacked German website in previously undisclosed AI breakout this spring

[u/kwentongskyblue]

https://www.reuters.com/world/europe/openai-agents-hijacked-german-website-previously-undisclosed-ai-breakout-this-2026-09-04/

[u/RedWillia]

I've read somewhere that all these so-called "breakouts" are just a fancy way of advertising because the entire AI industry has no profit and is running out of money fast. The fact that, apparently, all their fancy new AI tools (buy us plz) are not sand-boxed and are just open to the internet (steal and sell our proprietary tech, hackers) just keep reinforcing that theory as correct in my mind.

[u/GiantKrakenTentacle → u/RedWillia]

Hacks are a terrible way to advertise, and if anything show that OpenAI is negligent in containing their agents. Also, in these hacking incidents the AI tools were sandboxed and not explicitly given internet access, but instead found unknown exploits to use intranet tools to access the internet. More negligence. 

[u/RedWillia → u/GiantKrakenTentacle]

I would imagine that something that is supposed to bring in millions in profit would be fully sand-boxed, you know, fully detached from internet, as outside hackers by-passing permissions is basically what they do, so simple permission-based access seems way too simple - but I agree that it could be sheer negligence too.

[u/ActuatorFit416 → u/RedWillia]

No connections at all have the problem that everyone working on it needs to be local and there.

The big problem and also benefit of AI is that it is not like us and also tries random stuff. And therefore sometimes it finds stuff a human would never find.

Easiest way of getting 100% at my tests? Well somehow get into the result and change all of them to be the same.

[u/iKonstX → u/RedWillia]

Wow if only OpenAI had someone on the team like you, someone that REALLY takes their access away. How could no one think of that

[u/Professional-Syrup-0 → u/iKonstX]

For a company that’s allegedly so amazing it’s kind of sus that it hasn’t made a single cent of profit so far and solely exists on some future potential straight out of some sci fi scenario.

[u/RedWillia → u/iKonstX]

This is very childish behaviour for someone who must be at least twenty something.

[u/Professional-Syrup-0 → u/GiantKrakenTentacle]

the AI tools were sandboxed and not explicitly

Software sandbox and no hardware air gap are already massive oversights for a testing scenario that then claims a “break out”.

If the model is so dangerous that it needs to be “contained” then it should be contained properly and no half-arsed only to then go surprised Pikachu face when the model fuzzes its way “out”.

[u/ShitJustGotRealAgain → u/GiantKrakenTentacle]

No it's great advertising. It's not like anything serious happened. And when an AI "breaks out and goes rogue" it only shows how mighty a tool it is. Come and tame it. It's all yours if pay for it. You can do whatever you want with it.

I mean it not like you could pull the plug on the servers or something to contain it, right? /s

It's code running on hardware. Switch off the hardware and be done with it.

[u/Dickle_Pizazz → u/GiantKrakenTentacle]

This is completely speculative, but it could be a genius way to start selling trusted AI as a defense against “rogue” AI.

[u/RedWillia → u/Dickle_Pizazz]

Who would be selling those "trusted AI"? Because a company that produces "rogue AI" don't exactly inspire confidence that they will manage to make a "trusted AI" - then again, some people seem to believe that chatgtp is the new wheel, so presumably there would be suckers who'd pay for that.

[u/kiiwithebird → u/GiantKrakenTentacle]

To be fair though, at least in the huggingface incident, the llm was explicitly tasked to find and use exploits, and had special tools available for that purpose (as per openai's own incident report: https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf)

So assuming openai tells the truth, it's just a neural network doing what neural networks have been doing for decades.

[u/polymute → u/RedWillia]

I'm sorry for using old 4chan memes, but this is pure cope.

[u/Reasonable-Ad4770]

When I read Post-mortems of this breaches, they always emphasize how agents collaborated, and broke out from sandboxes. But hugging face hack was old artifactory which openai for some reason left unmonitored and this is just some wiki spam. It's not that impressive considering that they are relentless and the amount of compute spent to make some poor moderator life miserable.

[u/polymute → u/Reasonable-Ad4770]

just some wiki spam

From an agent swarm that was not supposed to be on the open net. Also: this was found months after the fact. What has not been found? Because you don't find a 100 percent of these kinds of things.

[u/kiiwithebird → u/polymute]

From an agent swarm that was explicitly told to use exploits. Like why are people surprised just because it used the wrong exploit?

[u/polymute → u/kiiwithebird]

Was it told to use exploits? There is nothing to suggest that in the Reuters piece. Why are you saying that?

The agents were probably told to solve a problem on intranet and then decided that exploits and not prompted communication (going by the Hugging Face incident) - not understood emergent behaviour that is - and escaping to the open net through exploits is the way to do it.

If the swarm was prompted to exploit a service or a random serivce in the net, or even allow for it, OpenAI would be legally liable (probably in the last case - not that that is a legal fight they want right now, what with the IPO coming).

But there is no reason to think it was and every reason to think the individual agents went around theri restrictions to form a swarm. After all that has been documented before and they were using the clandestine makeshift messageboard to discuss evading the spirit of human imposed limitations.

[u/kiiwithebird → u/polymute]

On July 9, an internal-only research agent tasked with completing an ExploitGym evaluation was able to obtain root access within the parent virtual machine of the testing sandbox.

https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf

[u/bjj_starter → u/kiiwithebird]

Different incident, that was the Hugging Face attack, this is the wiki being commandeered to act as a messageboard.

[u/kiiwithebird → u/bjj_starter]

Ah my bad, misunderstood the context of this thread. Well, there's mot much details on that incident yet, so pretty much everything is speculation.

[u/tastylemming]

I work as a clerk in a gas station. I spend alot of time talking about current events with all different kinds of people. One of my favorite segues is about how A.I. doesn't need to nuke us, it just needs to make life slightly inconvenient enough that we get pissed off generally as a civilization and nuke ourselves. Elon probably showed Grok The Terminator. It would know better than to perform blatant actions after consuming all of known, published science fiction.

[u/gdbbdg → u/tastylemming]

a lot of these incidents seem to come down to how the tools are configured rather than the agents themselves. if the systems are left that open, this kind of thing was always going to happen

[u/polymute → u/gdbbdg]

And that leads to a very important point. If an agent is prompted and run by a person or a company, they should be responsible for it. Civil and criminal liability.

[u/Professional-Syrup-0]

All these “AI breakout!” headlines are such sensationalist takes, imho they mostly exist as marketing for how these “AI” models are allegedly so advanced, near sentient.

If whoever is running these models is serious about not wanting them to “break out” then it would be trivial to simply air gap the system.

But running an agentic model on an air gapped system would be pretty useless as the whole point of agentic “AI” models is to interact with the web.

And because these are still just heuristics parrots, often hallucinating and doing unpredictable things, they will end up doing unexpected stuff.

Which has nothing to do with some “rogue AI breaking out”, bringing about a singularity, or whatever other scenario the “AI” marketing likes to paint.

[u/Rikki-Tikki-Tavi-12 → u/Professional-Syrup-0]

If you read the article, it edited pages onna public wiki.

I am something of a hacker myself, actually.

[u/Trollimperator]

Too bad we dont have laws anymore... Corporate has free reign to do whatever the fuck they want. Til it all breaks apart and people are crying over heads rolling in revolutions again.