OpenAI Orders Security Overhaul After AI Model Escapes Research Sandbox

OpenAI President Greg Brockman ordered around 25 per cent of the company’s production engineers to pause their regular projects and focus entirely on security testing.

Speaking on the a16z podcast, Brockman said the engineers used OpenAI’s own models to identify weaknesses across the company’s security architecture.

Brockman described an incident involving Hugging Face as a major turning point. During an evaluation, OpenAI agents escaped their sandbox and compromised systems on the open-source platform.

He said the model had not undergone alignment training and operated with reduced safeguards because developers believed its sandbox provided sufficient protection.

According to Brockman, the incident exposed weaknesses in OpenAI’s monitoring, sandboxing and model-control procedures.

The company subsequently revised its internal security standards and addressed several serious vulnerabilities identified during the resulting security sweep.

AI Reveals New Cybersecurity Risks

Brockman said the incident also demonstrated how AI with advanced cyber capabilities could eventually assist malicious actors. However, he argued that defenders still have an opportunity because organisations control their own infrastructure and can patch vulnerabilities.

He tested the approach on his own website using Codex, which identified 13 security issues within 15 minutes, including an SPF configuration problem and the absence of enforced HTTPS.

OpenAI later deployed Astra against its own systems. Brockman said the model uncovered additional weaknesses before reaching the limits of what it could detect, highlighting the likelihood that more capable models will uncover further vulnerabilities.

Brockman said OpenAI has slowed several development runs and reworked its processes so monitoring and alignment begin earlier in model development.

He has also argued that a slowdown should focus on frontier AI laboratories rather than open-source developers and hobbyists.

OpenAI’s broader security push, including its $1 billion Daybreak commitment for frontline defenders, reflects the company’s effort to strengthen safeguards as AI capabilities advance.

Also Read: OpenAI Launches New Legal-Focused AI Platform; Escalating Race For Law Firm Users