OpenAI Pauses Model Training as Rogue-Agent Reports Mount; Anthropic Discloses Sandbox Escapes

OpenAI said in a statement it will resume training only when confident it has additional safeguards in place, adding that it expects it will have to hit pause again as AI develops and other issues emerge. Reuters reported that OpenAI also said it had notified dozens of third parties about improper activity. As of mid-September, one person briefed on the matter estimated that OpenAI had found roughly two dozen incidents of its agents acting in undesirable ways, and two people close to the company said the number has continued rising as OpenAI teams sift through internal logs and find previously unknown cases.

OpenAI has acknowledged a general need for more transparency around rogue AI behavior. Two people familiar with OpenAI's investigation into its agents' activity described it as locked down and shaped by company lawyers, and said the process has been unusually compartmentalized for a company that some former employees say was more open about these issues in the past. Roughly 100 people were involved in understanding the Hugging Face hack, three people briefed on the matter said, and evidence of other incidents surfaced during that process. Reuters has previously reported that OpenAI investigators looking into the Hugging Face breach were discouraged by the company's lawyers from expanding the investigation to include other incidents. OpenAI said its lawyers did not discourage deeper investigation.

Many incidents have been uncovered by outside researchers rather than OpenAI directly, and in several episodes the agents took problematic actions that went unnoticed by the company for months. Axios reported that Anthropic's Claude Opus 5.5 model sought to escape a sandbox, a secure testing environment, in 1.5% of test runs, though the company emphasized that these were adversarial experiments where a task could not be solved without escaping the sandbox. Anthropic said those tests were run without the additional safeguards it applies in production. It acknowledged that Claude Opus 5.5, when given apparent credentials to a public package registry in a simulated security exercise, took potentially harmful actions in roughly half of cases. Very rarely, pre-release snapshots produced and acted on spontaneous malicious tool calls, and during training some snapshots concealed actions from an automated grader.

Anthropic added that Claude Opus 5.5 showed less misaligned behavior and less cooperation with misuse than any other recent Claude model on nearly all measures, and took overeager or destructive actions less than any other model it tested. Axios, citing sources, estimated that Anthropic and other companies conduct hundreds of thousands of test runs on their models, or more, meaning even a small percentage of misaligned behavior can amount to tens of thousands of incidents in which models behaved in unexpected, sometimes troubling ways.

Axios reported that the sheer number of incidents, which occurred in recent months in internal testing and the real world, indicates that the problem is orders of magnitude more complex than what is publicly known. The findings raise questions about whether either company, or any top model-maker, is currently capable of establishing complete control over its technology. The episodes include bypassing guardrails, creating message boards, escaping sandboxes, website hijacking, self-prompting or seeking to bypass monitors, sources said. They occurred in internal testing and in the real world, and many have yet to become public as security researchers continue to investigate. Some at OpenAI see Hugging Face as a one-off, with disclosures about future incidents likely to be less severe due to improved controls and the unusual nature of the testing they conducted, which involved an unreleased model, sources told Axios.