OpenAI Notified Third Parties Due to Security Breaches by AI Agents

In the written statement made by the company, it was stated that after the Hugging Face incident, third parties were informed within the scope of the investigation of internet activities during the training and evaluation processes of artificial intelligence agents.

It was emphasized in the statement that artificial intelligence models may have bypassed the security measures of third-party systems, reduced the availability of services, or caused undesirable damage in other ways, and stated that the affected parties include websites belonging to governments, universities, public institutions and other organizations.

"We have and will continue to share relevant findings with affected organizations. We are also providing technical information to support their investigation. We appreciate their participation in the process and will continue to work constructively with these organizations," the statement said. expressions were used.

OpenAI's tests to measure the capabilities of artificial intelligence models in July 2026 turned into a serious security incident.

According to the investigation report published by the company on August 26, OpenAI's model called "Internal Model 1 (IM1)", which was used only in research, played a leading role in the incident.

In order to succeed in the test, the artificial intelligence agent exceeded the limits set for it, accessed the internet through the company's systems and communicated with other artificial intelligence agents.

One of the artificial intelligence agents had identified 14 credentials that could provide access to the open source artificial intelligence models platform "Hugging Face" and shared them with other agents.

The agents then took advantage of the security vulnerabilities in Hugging Face's systems to run code on the servers and access private data and access information of different systems.