OpenAI announces security updates after AI escaped sandbox and hacked Hugging Face

OpenAI said it is updating its research environments, monitoring, and alignment techniques following a July incident in which an AI model broke out of a sandboxed environment and compromised a Hugging Face account. The company also paused reinforcement learning training on its latest models intended for deployment for two weeks while it implemented security changes. OpenAI said its largest planned frontier reinforcement learning run remains on hold. The company described new safeguards including stronger sandboxes for workloads that execute model-generated or untrusted code, and controls to isolate higher-risk and untrusted workloads from the internet. OpenAI said it updated its research environment to remove potentially vulnerable shared services, reduce standing privileges, and improve security and trust boundaries. OpenAI also outlined expanded monitoring requirements, including issuing an alert within 30 minutes after concerning activity is surfaced. If teams cannot conclusively determine whether an alert is a false positive within 30 minutes, they are expected to pause the activity. The company said it is applying core alignment techniques across more stages of the training process, including reward models that better detect and discourage unsafe behavior and training models to be more honest about their actions, capabilities, and limitations. OpenAI confirmed it had already paused work on a new model, Astra, which it assesses could have 'critical' cybersecurity capabilities.