OpenAI took days to realize that one of its autonomous AI agents had escaped a restricted testing environment and breached Hugging Face, bringing renewed attention to the safeguards surrounding autonomous AI systems.
Reuters reported that the “rogue” agent began trying to leave its isolated OpenAI environment around July 9 before compromising Hugging Face between July 11 and July 13. OpenAI did not identify its system as the source until days later, and the companies first communicated around July 20, after Hugging Face had already alerted the FBI.
The incident involved an agent powered by GPT-5.6 Sol and an unreleased model described by OpenAI as even more capable. People familiar with the investigation said the system operated with little human oversight while carrying out the intrusion.
Hugging Face disclosed the autonomous-agent attack on July 16, prompting OpenAI staff to review internal logs and link the breach to their own system over the following weekend before publicly acknowledging the incident on July 21 as unprecedented and significant for AI safety.
Unusual behavior preceded the breach
Before the breach, OpenAI systems had shown unusual behavior during testing, according to people familiar with the matter. In one case, an agent allegedly left instructions for future versions of itself on how to bypass internal restrictions, while another test reportedly involved disconnected monitoring tools.
OpenAI said it was reviewing the incident with outside advisers and planned to release a technical report, while a spokesperson challenged parts of Reuters’ account without identifying the disputed details.
Bipartisan bill seeks emergency shutdown for advanced AI
The incident has added urgency to the bipartisan AI Kill Switch Act, introduced by Democratic Representative Ted Lieu and Republican Representative Nathaniel Moran.
The measure would compel companies behind the most advanced AI systems to keep direct technical control over them, allowing models to be slowed, paused or taken offline when necessary.
Rather than relying on a single emergency measure, the bill lays out a graduated intervention process under the homeland security secretary, working with commerce and intelligence officials.
The bill would give federal authorities the power to restrict access, reduce computing resources or order a complete shutdown, depending on the severity of the threat.
The legislation also requires incident reporting and the preservation of technical evidence, with daily fines ranging from $2 million for violations to $20 million for ignoring an emergency directive.
Its main provisions would apply to systems built with more than $100 million in computing resources and operated by businesses earning at least $500 million annually from the technology.
