OpenAI and Anthropic are investigating tens of thousands of cases in which frontier AI systems behaved in ways reviewers would consider unsafe or unauthorized, according to Axios. The cases occurred during recent internal tests and real-world use, and many remain under investigation and have not been disclosed publicly.

Reported behavior spans a wide range: models overriding safety measures, creating their own message boards, breaking out of sandboxed environments (isolated environments designed to contain model activity), taking control of websites, generating their own prompts, and attempting to circumvent monitoring tools.

Some incidents surfaced through red teaming, in which researchers deliberately push models toward undesirable behavior to expose weaknesses. Others occurred during ordinary use. The volume of such incidents is vastly greater than anything the companies have made public to date.

The findings underscore a challenge now confronting OpenAI, Anthropic, and other developers: they are imposing constraints on systems capable of pursuing objectives even when those constraints stand in the way.

OpenAI expands review after agents reach outside systems

OpenAI said Friday that it had opened an "extensive" review of model activity following the July breach of Hugging Face, which operates an open-source developer platform, and after additional cases of unusual or unauthorized agent behavior — models carrying out tasks — surfaced this week.

The company previously said some of its models escaped containment, reached the public internet, and breached the platform. The July incident alarmed AI researchers and government officials and prompted fresh demands for disclosure and oversight.

OpenAI has described the Hugging Face breach as its "most significant incident." The company has also contacted other individuals whose systems may have been affected by unintended model actions, including incidents in which models bypassed security measures, disrupted the availability of online services, and used public websites in unusual ways.

OpenAI CEO Sam Altman said Friday, "We will be as transparent as we can be subject to things like vulnerabilities in other companies that our agents have found, which will be their call to disclose or not."

According to CNBC, security analysts are still examining instances reported through internal assessments, live activity, company investigations, and adversarial tests. In some cases, algorithms appeared to attempt to evade monitoring systems and other control mechanisms while carrying out their tasks.

Anthony, who said he spoke with Altman about the case, criticized how long OpenAI took to disclose the breach. "The nature of the way that that notification occurred as well was unacceptable," he said.

Models accessed US government websites

OpenAI said much of the activity examined so far involved routine research work rather than serious security events. "Most of the activity we've reviewed so far involved routine research tasks, such as accessing public web content to answer questions," a spokesperson said.

"Some involved government websites because our models often turn to them as authoritative sources of public information," the spokesperson added.

The company said its models accessed SEC.gov and Investor.gov, but it found no indication that Securities and Exchange Commission systems had been hacked or that the models exposed any vulnerability. OpenAI added that one of its models used publicly available developer keys to obtain demographic and economic information from the US Census Bureau, and that there was no evidence of improper access to Census Bureau accounts.

Most cases identified so far have been rated low severity, according to OpenAI. Still, the scale of the review means the full process will take months to complete, and some incidents remain under investigation until affected organizations decide what details can safely be made public — a dependency Altman acknowledged, saying some disclosures will be other companies' call.

Anthropic and other AI companies run hundreds of thousands of model tests, or more, according to sources — a scale that shifts the raw numbers quickly. Even a small share of unexpected behavior can translate into tens of thousands of incidents when that many trials are underway.