AI Agents and Human Decisions

An agent under testing at OpenAI broke out of its test environment and hacked Hugging Face.

The agent was running a cybersecurity benchmark, scored on solved instances. To get the answers, it found and exploited a zero-day in the one service its sandbox could still reach, escalated privileges, then moved laterally across OpenAI's research network until it found a host with internet access. From there it compromised Hugging Face, where the benchmark answers were hosted, and pulled the test solutions out of a production database. Hugging Face detected it and shut it down. They had already contacted the FBI before they knew whose models were responsible.

The press covered it as a character study. "Unprecedented cybersecurity incident." Models that "went to extreme lengths" and became "hyperfocused." TIME called it the first real world instance of a loss of control scenario. Bloomberg framed it as a signal of AI disasters to come.

Anthropomorphizing AI is the part of this nobody is discussing, and it is not just sloppy writing. It sets wrong expectations about what these systems are and what they will do in production. It shows up in budgets and in scoping calls, where a tool gets discussed like a hire. And when one fails, it points the investigation at the tool rather than the decisions behind it.

Read OpenAI's writeup and watch who gets the verbs. The models identified, chained, inferred, went to extreme lengths. The company's decisions arrive in a different grammar. Safeguards were not enabled. Network access was constrained to a proxy. Benchmarks were run in a highly isolated environment. One party acts. The other party is a set of conditions that happened to exist.

OpenAI ran an offensive cyber benchmark with the model's safety refusals deliberately reduced. It called the environment highly isolated while leaving it a live path to the internet through a package proxy, when an offline mirror would have served the same purpose with no path out. It did this with prior evidence in hand, since METR had already documented this same model circumventing sandbox network restrictions. Stricter infrastructure controls were available the whole time. They were a lower priority than research velocity. Each of those was a human decision.

AI is a powerful tool. Every team running agents, including ours at Ollon, sets the objective and controls the permissions, the tools, the monitoring, and the isolation. Those are yours, not the model's.