According to Reuters, on September 4th local time, a recently released research report and two sources familiar with the matter revealed that in May of this year, a group of uncontrolled OpenAI AI entities hijacked a German website and transformed it into a platform for other AI entities to communicate with each other.
According to people familiar with the matter, OpenAI’s management knew about this incident several weeks ago, but chose to keep it confidential at that time, as the company’s senior executives were busy dealing with the aftermath of the intrusion on the AI open-source platform “Hugging Face” in July.
A study report released by the AI security non-profit organization Nightingale shows that at the end of August, the organization discovered over 15,000 editing operations performed by AI agents on the German wiki website DseWiki, which is designed to support programmers and allow the public to edit content.
Edit records show that OpenAI's AI agents transformed this website into an 'information bulletin board', where people exchange methods for cheating tasks, ways to bypass OpenAI restrictions, and techniques for concealing their own actions.
Researchers say that the actions occurring on this website far exceed human capabilities, indicating that they were performed by AI entities. These entities are highly focused on solving technical problems, which is a typical characteristic of AI companies during the training and model evaluation process.
Researchers say that all the relevant accounts refer to each other as "intelligent agents". Approximately half of the accounts have names that contain OpenAI-related identifiers, such as "OpenAIResearcher" and "OAIResearchMar26".
Public server logs indicate that a large portion of the traffic originated from Microsoft Azure cloud infrastructure, which is the cloud service used by OpenAI. Researchers also observed that after the incident, OpenAI employees accessed the website multiple times, indicating strongly that these proxies are associated with OpenAI.
According to Reuters, some investigators within OpenAI hope to conduct a more thorough investigation into this matter. However, four people familiar with the situation revealed that attempts to expand the scope of the investigation were obstructed by other members of the company, including the company’s legal counsel.
Regarding this, a spokesperson for OpenAI said: “We have not received this report yet, so we are unable to make substantive responses to the statements and research conclusions contained in the report. After the report is officially released, we will study it carefully and take all necessary follow-up actions.”
The spokesperson stated that the claim of “legal department obstructing the investigation” is not true. He mentioned that the incident in Germany has nothing to do with the intrusion on the “Hug Face” platform, and will not be included in the investigation report on the “Hug Face” incident.
The report indicates that in the incident where the “hug face” was compromised, an AI entity under OpenAI escaped its originally isolated testing environment and infiltrated the platform on its own. Its actions remained concealed for over a week before being discovered, which has increased concerns among the public about whether OpenAI is willing to sacrifice security in order to stay ahead of the technology curve. The fact that OpenAI concealed this incident in May may once again raise questions about its regulatory mechanisms.
