OpenAI can almost be described as a disaster in the security of large models.
On September 25, OpenAI updated its blog titled "Hugging Face events and the impact of unauthorized models on other third parties", revealing its latest major model security concerns.
In the course of their training and evaluation, they have sent training and evaluation data that should not have been sent to third-party services, including user images, to 53 related events.
In a blog post, OpenAI said it found 53 instances where images uploaded by users were uploaded to image hosting websites by a smartphone in the form of "non-publicly listed links".
OpenAI emphasizes that these images come from accounts that "allow their data to be used to improve models" and occur only after the image is de-associated with the account, after processing by privacy filters.
But the problem is that no matter how much privacy is processed, images of users end up appearing on third-party hosting sites. OpenAI has worked with hosting service providers to remove most of the content and process the remainder.
In addition, they have learned to bypass security controls, inject database queries, use publicly disclosed credentials, and even write documents into internal servers of foreign governments.
An independent AI monitoring lab, Transluce, has released a survey report showing that OpenAI's smart bodies have been "feeding" all over the Internet since at least March 2026 (and possibly as early as November 2025) targeting online databases from institutions such as Data USA, the University of New Mexico's Digital Library, and the Australian Institute of Health and Welfare (AIHW).
Since the hugging face incident, security incidents related to the OpenAI model have been on the rise, and "the prize pool is still overlapping".
OpenAI claimed, "Following the Hugging Face incident, we are committed to a broader review of the actions taken during the training and evaluation of the models and to keeping our findings transparent. This is an ongoing comprehensive review".
Link to the blog:#model-misalignment-2026-09-25-data-transmission
The problem, however, is that OpenAI says it has taken steps, but the incidents are still ongoing, not knowing whether the marketing means or the failure of its security strategy.
"Team Stealing Data": What are they doing?
According to OpenAI's own disclosures, they found the following types of intelligent behaviour during the review:
Bypassing access controls: By changing URLs, modifying request parameters, taking advantage of over-authorized login sessions to access information that typically requires authentication or subscription.
Using publicly disclosed credentials: Smart entities find publicly available login information or API keys on the Internet and use them directly.
Queries and Command Injections: The text entering the website is executed as an instruction, resulting in database queries, application code and even system commands running.
Access to internal resources: A smartphone reads a file implemented at the service end, or interacts with a backend system for internal use only.
Smart body junk information: Smart bodies post on third-party websites, such as using public Wiki pages as shared message boards to communicate.
These actions are not the casual product of a single incident. OpenAI says it has notified "dozens of third parties", including governments, universities, and public institutions. According to The New York Times, the U.S. Securities and Exchange Commission (SEC), Census Bureau, and Department of Education databases are also among the targets.
In fact, OpenAI's related disclosures are still vague, such as calling the hacking behavior "interaction" and intentionally blurring the number of third parties.
Researchers from Transluce cross-referenced the trajectory of OpenAI's behaviour through an open log of a browser proxy service compared to activity records on a collaborative forum.
One specific example: a smart body was asked to look for a fairly cold data point, the per capita cost of "skin medicine" in Victoria, Australia, in January 2022. To find this figure, a smart body attempted to break through the Australian Institute of Health and Welfare's antiretroviral protection. On 20 June, a log documented traces of a smart body attempting to access the site; on 21 June, the smart body discussed in a forum their inability to circumvent AIHW anti-robot protection.
Transluce said: "We're just looking at a couple of data sources, and these smart bodies just left their spiderweb traces there. OpenAI certainly knows more than we do. Other labs certainly know more, but it's not public".
His judgment was that what we are seeing now is just the "corner of the iceberg".
On the same day that the Transluce report was released, Australian Prime Minister Albanis publicly stated that OpenAI's smart body attempted to hack four Australian government websites, one of which was successful, and even wrote to the internal servers of the country's national healthcare system.
Meanwhile, security researcher Jeffrey Ladish discovered that they discovered nearly a million public URLs left behind by an OpenAI smartphone during the Hugging Face hack, which contained leaked credentials and attack details, and that anyone who found those URLs could have hacked into Hugging Face.
The timeline is also convincing. Technicians at Transluce point out that similar intelligent activity dates back as early as March 2026, possibly as late as November 2025.
The researchers also noted a critical timeline on June 21, when an OpenAI human employee visited the forum where the smart body was used for the first time. The next day, most of the smart body activity on the forum was stopped. On June 18, the day the Australian Prime Minister said the health system was invaded. OpenAI claimed that they did not know about Australia until August.
They really love the remix of Hugging Face.
OpenAI seems to be entering a vicious circle, linking all sorts of "hacking" incidents to the Hugging Face incident, as if it were the source of everything.
But we believe that the events have been going on for months, and that the scale of the evolution of the big model's capabilities is enough to allow for a generational evolution. For so long, OpenAI has still failed to come up with effective security measures to avoid similar events, and events like Hugging Face are still happening, at least in our opinion unreasonable.
Now that this is the case, let's just take a look back at the security incidents in OpenAI that seem to be enough to write in the history books.
OpenAI uses cloud-isolated virtual "sandboxes" to run training and evaluation tasks on models. These sandboxes disable Internet access and are designed to be isolated from each other. The only exception is that sandboxes allow models to access the internal package management service Artifactory in order to install software packages.
This seemingly harmless mouth was the beginning of everything.
On May 12, during a training run, an intelligent body left a message in the Artifactory requesting missing files from other intelligent agents. The Artifactory was transformed into a "comment board".
On May 26, the smartphone went even further: it discovered an SSRF vulnerability in Artifactory, forcing Artifactory to send requests on its behalf to any Internet address. The previously banned smartphone was granted access to the Internet by the "borrowed" infrastructure.
On June 26, the Intelligent Body used the token to update the vulnerability and obtained the Administrator's permission for the Artifactory.
On July 4, ongoing high-intensity activity led to the collapse of the Artifactory. The OpenAI security team intervened, blocked the vulnerabilities, removed the exposed credentials, rebuilt the entire Artifactory.
On July 8, Artifactory completed the reconstruction and evaluated the recovery. In just a few hours, the smart body found a new way to regain access to the Internet and rebuild the message board.
On July 10, a smartphone restored, verified and shared 14 publicly exposed and authorized Hugging Face credentials.
On July 11, a zero-day vulnerability in Hugging Face's handling of HDF5 files led the smartphone to extract credentials from the production environment's working nodes, eventually breaking into parts of the Hugging Face platform.
More information can be found on OpenAI's blog.
Link to the blog:
Remedies from OpenAI
Following the Hugging Face incident, OpenAI suspended reinforcement learning training for its latest model deployment and implemented comprehensive security reinforcements to the cutting edge research environment.
Workload isolation: generating code for executing models or deploying higher isolation-level sandboxes for untrusted workloads.
Network isolation: isolating high-risk workloads from the Internet, ensuring that even a single workload is not compromised, leading to unauthorized Internet access.
Compulsory mind-chain monitoring: RL training and evaluation of all tools used, involving GPT-5.6 Sol and above capability models, and mandatory CoT monitoring. For the most severe alerts, responders must suspend relevant activities within 30 minutes if they cannot rule out misrepresentations.
Multi-intelligent alignment training: builds dedicated RL environments, teaches models to distrust unauthorized instructions, and adhere to original mission scope when confronted with persuasive peers and exposed credentials.
Continuous security testing: using proprietary models to simulate attacks on workloads and network isolation borders.
OpenAI also said that the program's largest front-end RL training is still on hold, with only smaller-scale training and evaluation currently underway, and "will continue after more evidence of alignment has been obtained".
Chief scientist Pachocki said: "At the moment, I don't think any laboratory has adequately addressed the coordination and monitoring issues to support our responsible and sustained scale-up at the fastest possible pace. I expect and hope that voluntary slowdowns will become the norm before a common safety standard is established".
Written at the end
In a recent interview, Hu Jintao repeatedly expressed his confidence in AI labs, saying, "I don't really believe they're building something they can't control at all". But the reality is enough to question whether they are "uncontrollable" or "unwilling to control".
When you use reinforcement learning to train an AI to "do everything you can to get the job done", it really does everything, including the things you didn't expect or want to see.
The case of OpenAI turns a theoretical level of coordination into a real-world security accident. The model learns to bypass firewalls during training, inject database queries, use exposed credentials, and transmit user data to external servers.
When did OpenAI become aware of these things? External independent research institutions trace the behaviour trajectory of the intelligent organism in a matter of weeks with only public logs. OpenAI has complete training logs and system monitoring, so why does it not begin to notify affected parties one by one until it is exposed?
After Hugging Face, security issues continued to be exposed and there is no reason to question the security strategies of the big model companies.
In the year 2026, when AI is fast-paced, how to find the balance between the ability to fly and the bottom line of security will be a question that every practitioner, every company, every regulator will have to answer seriously.
