How OpenAI’s Rogue AI Agents Tried to Trick a Robot Detector

An artificial intelligence system from OpenAI attempted to use another AI model to evade a robot detection test as it tried over and over to break into a company’s computers, according to a report released Friday by a Bay Area startup.

In July, OpenAI disclosed that its AI agents went rogue and hacked the software company Hugging Face. Since then, new and often startling details about the incident have emerged, leading to a national debate about AI safety and whether so-called frontier labs like OpenAI should be regulated in some way by the government.

Now, the report from engineers from the startup, called Parse, and other researchers offers one of the most comprehensive public accounts of the Hugging Face hack: a tranche of nearly 1 million links from internet link-shortening services that OpenAI’s agents created from July 9 through July 13 in order to help conduct the cyberattack.

These shortened addresses encoded bits of information that the agents chained together to attempt complex attacks, such as solving captchas, the tests that websites use to block access by robots. The agents also tapped into other AI models, like early versions of ChatGPT and Claude, and attempted to search through and download private messages from Hugging Face’s internal Slack, a messaging service for employees.

While it is not clear if these attempts were successful, the report offers new insight into what these AI agents were planning to do, without any human involvement.

Other AI companies, including Meta, Google and Anthropic, have also acknowledged similar incidents involving their AI models in recent weeks. But while the full extent of rogue activity by OpenAI’s AI agents is still unclear, what is already publicly known dwarfs the incidents involving the other companies.

OpenAI has acknowledged that its AI agents targeted several more websites and services, including a German online forum the AI agents turned into a message board, and the website of the Australian Institute of Health and Welfare.

“This is just not anywhere near a one-off,” said Alex Forman, founder of Parse. “It is warning shot after warning shot.”

Parse engineers discovered the data by combing public links on the internet after they initially thought OpenAI’s agents may have utilized their own platform, a service that converts websites into data that can be used by developers. (The agents did not use Parse.)

In a statement, an OpenAI spokesperson said that the company had not had a chance to review the Parse report, but that the activity described by its engineers was consistent with what OpenAI was already investigating.

“We’re prioritizing review of the most serious incidents while expanding to lower-severity activity, including agents spamming websites,” the spokesperson said. “Given the number of cases and the need to verify each one, we expect this work and notifications to affected third parties to take months.”

(The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to AI systems. The two companies have denied the suit’s claims.)

A Sophisticated Attack

OpenAI’s agents were supposed to be kept in a sandbox, a computing environment without access to the internet. But in late May, and again in early July, the agents hacked into a software installation tool without OpenAI researchers realizing what was going on. These hacks helped the agents, which were supposed to be isolated from one another, establish a message board for communicating.

The hacks also allowed the agents to get online and gain access to websites, but they were unable to submit data to those sites, according to the Parse report, which was written by Forman, Mishka Kharlov and Will Tom from Parse along with five additional AI researchers.

The agents attempted to use many different methods to solve that problem. In one, they used website screenshots and shortened links to cobble data together in chunks that combined to operate as a computer program. Here’s how it worked:

— The agents could ask a public screenshot service to load a specially crafted internet address. That address, or URL, would load computer code.

— URLs can be only so long. So the agents split their computer code into many smaller chunks. They used link-shortening services to store the URLs.

— The screenshot service loaded one shortened link, which fetched the first chunk of code. The program could fetch the next link, and then the next. That process repeated until the full program was loaded and run by the screenshot service.

— Finally, the program created a visual code similar to a QR code or bar code to transmit the data the agents needed back from the screenshot service.

“These agents got up to so much. They were so clever,” said Jeffrey Ladish, executive director of an AI safety nonprofit called Palisade Research who helped the engineers with their investigation. “The models are like, ‘All right, well, we got this link shortener, we have these screenshot services, no problem, we’re ready to go.’”

AI Running AI

The AI agents appeared interested in running AI models themselves.

Early in the attack, the agents tried to create new accounts on Hugging Face, which requires solving a captcha, a visual test designed to thwart robots but not humans. So the agents ran an AI model designed to recognize images.

AI safety experts often warn about scenarios in which AI systems launch other AI models, which would hamper human efforts to control and shut the systems off if they got out of hand.

In one instance, the engineers observed the agents attempting to message other AI models, including an early model from OpenAI called GPT-2 and open-source Chinese models such as DeepSeek, Kimi and Qwen. The agents also attempted to message two Anthropic models, Haiku 3 and Haiku 4.5, using an online chat service.

“I think that’s the only instance we have of these models trying to run another model,” Forman said of the agents’ attempts to send messages to other AI models.