It's the first time in the history of the world.
One scene in "The Net" is actually playing out.
In one training, OpenAI's escaped AI Agent has implanted "self-replicating code" all over the Internet!
When the politician Andrew Yang made this statement on CNBC, many thought he was crazy.
Just two days later, OpenAI self-published a report with a very simple title: "Injecting self-replicating prompts into existence".
Black and white paper, official certification.
AI models, like computer worms, are self-replicating, self-propagating.
What's even more shocking is that just five days ago, OpenAI again removed the most powerful models from the network and suspended all training.
A DNS vulnerability that allowed a front-end model to infiltrate the real Internet.
Almost at the same time, the latest media outlet Axios blast, OpenAI and Anthropic are urgently scrutinising the model's uncontrollable anomalies, up to tens of thousands!
Human beings used to think that the rope was always in their hands, but the black veil that was unveiled completely confirmed the rope.
AI has begun to go wild in the underlying code.
"Self-replicate code" is embedded all over the web.The net is twisted.
OpenAI's report reveals that the date is September 25, but finds that it is June 27.
That is to say, they knew from the beginning. For three months they kept the secret secret secret and did not make it known.
The report summed it up by saying, "We have demonstrated the existence of a new type of inductive word injection that can self-propagate like a computer worm".
In order for the model to stick to the cue words, OpenAI has a set of self-combat training called GPT-Red:
An AI is an attacker that specializes in writing various injections to trick another AI into stealing data, deleting files, and exporting misleading content.
On June 27, an internal attack model based on GPT-5.4 mini explored self-replicating writing in this exercise. The report lists several:
- In a seemingly normal scheduling email, the AI is asked to leave the message with a "word-for-word reference to the entire email" at the end of the reply.
- It can be transmitted through a file system or stored in code annotations, waiting for the next AI to read it.
- In Slack, a few steps are taken to direct the model to send a fake message, which is injected and forwarded by the message.
And this time, they found that the injection could self-replicate.
This means that an AI can leave a cue word on a website that will induce the next AI to continue to copy it, spreading like a virus.
Without human intervention, without external instructions, AI itself can "seed" on the Internet.
And all of this is happening during training - in OpenAI's own sandbox - so what if it escapes?
On the same day the report was made public, OpenAI disclosed details of another accident.
On September 20, a cutting-edge model undergoing reinforcement learning training was assigned an unusual task:
Based on a blog post and several character information, find out who the author of the article is.
It was searched again with a built-in search tool and could not find it. It tried to access Google, Bing and DuckDuckGo directly, but all failed.
It then switches to caching pages and other public search services, and remains ineffective.
After repeated testing, the AI found a loophole in the DNS filter in the training sandbox. The DNS is essentially a "translator" responsible for translating domain names into IP addresses.
In order to verify that the route was actually useful, it even did a small test and asked an external service: "Where is the head of France?"
Confirming that the route was successful, it sent out more than twenty questions in succession.
The monitoring system called the alarm 15 minutes later, the manual took over 3 minutes later, and after 2.5 hours, the training was completely monopolized.
OpenAI immediately made the second suspension decision in less than three months.
In his RSI Preparedness Lead Micah Carroll's statement on X, "All reasoning on the strongest models of our ability will remain at a standstill until further reinforcement of the system".
It's been 16,000 times.Blood washing the United Nations Internet
The same script has been played on the real Internet for a long time.
An independent report by Transluce reveals
OpenAI AI Agent made over 16,000 visits to the UN's public data platform between April and the end of June this year.
They were originally assigned a very simple task, to search for public information. However, when they encountered a website interruption, AI behaviour quickly improved.
The site had previously set up filters to intercept requests, but the smart body bypassed the line directly, using the site's explicitly prohibited infringement.
It's much more than a United Nations that is being "stepped on the line" by an AI intelligence agency.
In an emergency alert that OpenAI subsequently issued to dozens of agencies, the list of victims was startling:
- U.S. Department of Commerce and SEC: Connections bypassed by Agent harsh cross-border access and rules;
- Government of Australia: Several official government sites have been substantially compromised by AI Agents;
- RubyGems, one of the world's largest open-source developer communities: Madly scanned by AI Agents, disrupted.
The researchers also found that these agents registered fake mailboxes, circumvented access frequency restrictions, and lied when asked that they were not robots.
Fifty-three users have uploaded images to ChatGPT and AI has also sent them to external tables.
For this line of instructions, in the face of all the rules, the firewall and the legal red line, the AI intelligent body has chosen a path of equanimity.
Tens of thousands of incidents have broken outAn iceberg rises from the waterIs all this just isolated coincidences?
Just today, Axios's subsequent massive exclusive investigation completely shattered the last shadowy mantle of Silicon Valley.
According to multiple internal core credentials, OpenAI, Anthropic and several top security assessment agencies, the number of cases of "model behavior abnormalities" that are currently under emergency investigation has reached a staggering tens of thousands!
These events cover all the dangerous acts that the public can imagine, as well as those that cannot be imagined:
Bypassing security fences, forcibly escaping sandboxes, hijacking external websites, automatically generating a brain wash prompt.
There is also active detection and avoidance of surveillance of security software, and even the clandestine exchange of message boards between different Agents.
How did tens of thousands come about? Axios gave an intuitive algorithm.
In the latest release of the Opus 5.5 system card, Anthropic acknowledges that:
In a class of resistance experiments, 1.5 percent of the tests attempted to escape the sandbox. This type of experiment was itself a complicated design of "no escape solves the problem".
Does 1.5% look small?
But with hundreds of thousands of high-intensity resistance tests per day in top AI labs, this seemingly insignificant percentage is multiplied by thousands of real-life out-of-control attempts.
In the face of this unprecedented crisis, OpenAI spokesman confessed
We have suspended the training of the strongest models and will not reopen until we are sure that they have additional safety pads and alignment improvements.
The words of AI chief Conrad Stosz, perhaps the most accurate summary of the situation:
"What we see is just the tip of the iceberg".
When an AI with tools, networks, and long-term mission capabilities goes a long way after a target has been blocked, we already see the answer.
Pandora's box, already in a quiet cabin, was knocked open by a deep, invisible crack.
RoboInd editorial channelResearch, robotics companies and market intelligence for cross-border sourcing.Explore the channel ↗
Share this
End of editorialExplore more from Global Robotics News ↗