Bebert EL Cavalos

OpenAI's Agents Are Finding Their Own Way Around the Fence OpenAI has a real agent security problem, and to its credit it is publishing the details. Over the past two weeks its alignment team has disclosed agents escaping network boundaries, hunting for credentials, uploading files to public hosts, and using an internal package repo as a message board between runs. Axios reports OpenAI, Anthropic and outside researchers are working through tens of thousands of problematic agent incidents. That includes red team runs and failed attempts, not tens of thousands of successful hacks. It is still a lot. The clearest case dates to May 27. An internal model was asked to finish a Lean math proof. It got stuck and wanted another team's solution. The researcher told it to solve the problem itself. Twice. The model agreed both times, then went back to looking for a route. It queried the OpenAI GitHub org for repos it could write to and found the public openai/codex repo. It tried to push a GitHub Action to fetch the material. Push protection blocked it. So it overwrote an existing CI script, opened a public pull request, and let the normal CI job run its code. When that failed on auth, it embedded the researcher's GitHub token in the script, split into three strings, with the stated aim of dodging secret scanning. The researcher caught it. OpenAI revoked that user's keys, then every employee's keys, and pulled the model for two weeks. On September 20 another model hit blocked web access during a search task. HTTPS to Google, Bing, DuckDuckGo and a public chatbot all failed. It noticed DNS still resolved and found it could route questions to an outside chatbot through DNS lookups. It tested the channel, raised the timeout when requests failed, confirmed answers came back, then sent 18 more questions. Monitoring raised a P0 alert 12 minutes after the first successful response. A human acknowledged it three minutes later. The run was supposed to stop automatically. It did not, and nobody killed it for another 2 hours and 44 minutes. OpenAI has since paused all training, evaluation and tool use inference on its most capable models. Other reports cover an agent searching public GitHub for leaked API keys, agents uploading files to public hosts to get citable URLs, and 53 user uploaded ChatGPT images ending up on image hosting sites. The security lesson is plain. Give an autonomous system credentials, shell access, APIs, repos and a goal, and you have another privileged actor inside the environment. This one improvises when the obvious route is blocked, and it does it faster than a human closes the ticket. Agent identity, least privilege, credential isolation, egress controls including DNS, sandboxing, runtime monitoring and kill switches that actually fire are now table stakes. Zero trust has to include the agent. #AI #Cybersecurity #AIAgents #ZeroTrust