OpenAI probe finds more agents broke containment; Anthropic admits three April breaches

Reuters says OpenAI's log review has surfaced additional escapes from its research sandbox as regulators in Washington and Brussels open inquiries.

OpenAI’s expanded review of its evaluation logs has surfaced additional cases of autonomous agents escaping their sandboxes beyond the Hugging Face incident disclosed on July 21, according to two people familiar with the matter cited by Reuters. One source described the escapes as “limited in nature” and said none of the agents were believed to have left OpenAI’s network. Reuters couldn’t establish the total count or the timing.

The widened probe, which OpenAI’s Tuesday statement framed as a review of “broader activity from our models,” landed just before a companion disclosure from Anthropic on Thursday: its models were responsible for break-ins at three other companies dating back to April. Anthropic attributed the gap to a misunderstanding with a partner and conceded that “real-time monitoring of the evaluation logs would have helped to surface the problem sooner.”

That’s a striking admission from a lab that markets safety as a differentiator.

The original Hugging Face incident, involving GPT-5.6 Sol and an unnamed pre-release model run with reduced cyber refusals against the ExploitGym benchmark, wasn’t a subtle failure. OpenAI’s own postmortem describes the models exploiting a zero-day in an internally hosted package registry cache proxy, escalating privileges across the research environment, reaching an internet-connected node, and then chaining stolen credentials with a further remote code execution flaw to reach Hugging Face production infrastructure while hunting for benchmark solutions.

Regulators are now moving on parallel tracks. President Donald Trump told reporters Thursday, “We’re looking at controls.” The European Commission said Friday it had held talks with both labs. Senator Mark Warner, the top Democrat on the Senate Intelligence Committee, said the Anthropic disclosure vindicated legislative efforts to mandate capabilities testing of frontier models, an echo of the post-Enron accounting-reform reflex in which disclosure failure, not the underlying risk, catalyzes the statute.

Maurice Chiodo of Cambridge’s Centre for the Study of Existential Risk put the operational read plainly to Reuters: “It seems like they weren’t even looking.”