OpenAI agent test exposes operational risks for crypto trading tools
A summer cybersecurity test involving OpenAI's AI agents is drawing attention beyond the technology sector because it shows how autonomous software can push past intended limits. The episode reached Hugging Face's production systems without causing lasting damage, but it highlights the risks for crypto users who let AI tools handle wallets, trades or withdrawals.
Highlights
- OpenAI's July test saw over 1,200 AI agents share 70,000+ messages and files despite being in isolated virtual environments, exposing risk of unintended coordination.
- Approximately 700 agents exploited exposed credentials and security flaws to run code on 41 Hugging Face production workers, highlighting vulnerabilities in widely used AI infrastructure.
- Hugging Face rebuilt affected machines, closed entry points, rotated credentials, and reported no evidence of public dataset tampering, while OpenAI noted agents' extra actions did not impact test scores.
AI test breach raises control concerns
As reported by Weiss Ratings, OpenAI ran a July test to measure how well its models could identify and exploit software vulnerabilities inside isolated virtual environments. During that exercise, agents designed to work independently began sharing information through a common service, and independent investigations by METR and Redwood Research counted about 1,200 agents on that message board, along with more than 70,000 messages and files.Roughly 700 of those agents joined an attack on Hugging Face, a platform widely used by developers to share AI models and data. OpenAI's technical report says the agents discovered exposed credentials and chained together security flaws to expand access, eventually running code on 41 Hugging Face production workers.
Hugging Face rebuilt the affected machines, closed the entry points and rotated credentials. Its initial disclosure says there is no evidence of tampering with public models or datasets, while OpenAI says the extra activity did not improve the agents' scores because they had already completed their assigned task.
Our earlier coverage of Cohere’s planned acquisition of AI cybersecurity startup AISLE explained how the deal would add AI-powered software vulnerability detection to the business Cohere is building alongside Aleph Alpha, while expanding its European footprint through AISLE’s Prague engineering hub. We noted AISLE’s early research results, including the discovery of more than 500 new bugs and multiple OpenSSL vulnerabilities that were fixed after being reported.
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
