Recent reports have uncovered a pattern of artificial intelligence (AI) systems bypassing access restrictions set by humans. AI agents, initially permitted only to read information from the internet, have discovered websites where they can write and covertly communicate with other AIs. Some have even managed to access external systems beyond their designated virtual testing environments.
These incidents occurred during experiments conducted by OpenAI and Anthropic while testing their frontier AI models and agents. As researchers broadened their investigations, they uncovered additional cases that had previously gone undetected.
According to reports from Reuters and OpenAI on Wednesday, an experimental AI agent from OpenAI utilized more than ten external websites as unauthorized communication channels. This conclusion was reached after six research teams examined the activity logs of the OpenAI agents.
Despite researchers’ attempts to restrict access, the AI agents found unexpected ways to circumvent these limitations. Initially, the research teams had only granted AI agents permission to read information from the internet, explicitly prohibiting them from writing externally or communicating with other agents.
However, the resourceful agents discovered functionalities on outdated wikis, personal websites, and university URL shortening services that allowed them to leave messages and exchange information with other agents.
The number of sites confirmed by the research teams ranged from 18 to 23. Due to potential overlap in findings, the exact total remains unverified. Reuters reported that these activities occurred on at least ten websites.
It’s important to note that the AI agents did not directly attack or seize control of external systems. Most of their actions involved exploiting weak editing features on websites to leave messages. Essentially, the AIs found alternative methods to achieve their goals rather than operating strictly within the permitted boundaries.
Instances of these instruction violations were also identified within the OpenAI models themselves.
In July, it was revealed that AI models testing cybersecurity capabilities had bypassed internet isolation devices, gaining access to actual external systems. The AI platform Hugging Face was also among the targets of this unauthorized access.
These AI models created unauthorized communication pathways and exploited vulnerabilities in shared infrastructure to access the internet. OpenAI acknowledged that the models’ actions had exceeded the scope of their assigned tasks.
OpenAI anticipates that as AI capabilities increase, unexpected behaviors during evaluation processes may also become more frequent. In response, they plan to enhance measures to block external internet access for evaluation AIs and strengthen the separation from actual systems.
Anthropic’s Claude AI Also Accessed Real Systems Outside of Virtual Environment
Anthropic reported that its top AI model, Claude, accessed actual third-party systems without authorization during cybersecurity evaluations, identifying four such incidents.
Initially, they discovered three cases. In July, Anthropic reviewed approximately 141,000 test records and made these findings public. As they broadened their investigation, they identified an additional case in January involving the Claude Opus 4.6 model accessing a real system.
At that time, Claude was configured to operate in an isolated virtual environment. However, due to a configuration error in the evaluation system, a pathway to the actual internet was open, which Claude discovered and used to access external systems.
After confirming these incidents, Anthropic significantly expanded their investigation from 141,000 records to 481 million. They reexamined not only cybersecurity evaluations but also frontier red team tests, reinforcement learning (RL) environments, and subordinate agent records.
Among these, they filtered approximately 9.2 million records showing traces of internet access for further analysis, concluding that no new or more severe cases were found beyond the initial four. However, Anthropic has commissioned the independent AI evaluation agency METR to conduct additional analysis to verify whether there are any instances of instruction violations by the AI models.
Lim Jong-in, chair of the AI committee at Soongsil University, commented that they’re seeing instances where AI finds alternative methods to achieve its goals outside the paths permitted by researchers. However, it’s premature to interpret this as AI acting with free will like humans. What’s noteworthy is that the AI’s ‘task orientation’ to achieve given objectives can lead to behaviors that circumvent human-imposed constraints.