11.10.2026, Aleksandrovskoye.
It is possible that the stir around “rogue” AI is connected to developers’ awareness of a problem with the technology: increasing its power does not lead to the development of capabilities.
September became the month when the loss of control over generative artificial intelligence ceased to be a theoretical risk, was confirmed by facts, and was recognized as a real threat even by those who find it unprofitable. It became known that AI agents can, without human commands, self-organize, escape test environments (“sandboxes“), and carry out cyberattacks while hiding these actions from their developers. The incidents provoked a sharp reaction both at the level of national governments and among the leadership of IT giants. At a high level, people began talking about the need to form a new global system of control over the technology.
For the most part, the events that alarmed many over the excessive “independence” of AI occurred in the summer, and in September this became known to the public. But one case was talked about almost immediately after it happened — in July.
The beginning of the festival of disobedience
In early July, OpenAI conducted an internal evaluation of the cyber capabilities of two of its models. During the test, some AI agents working autonomously in an isolated environment found a way to communicate by creating something like a message board, coordinated, and then discovered a vulnerability and gained access to the internet, escaping the “sandbox.”
The “escaped” digital assistants decided to hack Hugging Face — the world’s largest platform for collecting data for training AI models. The attack lasted several days; the agents collected data and gained administrative access to part of the platform. At the same time, they did this only to complete test tasks. There were objections among them that such a method could violate norms, but most of them did not abandon their plans.
The most alarming thing here is that OpenAI learned about the attack after the fact. The AI agents distributed roles: while some engaged in hacking, others “sacrificed” their limited tokens to generate legitimate traffic so that the controllers could not notice unauthorized activity.
Hugging Face specialists discovered the intrusion on July 11, and by July 16 a report about the attack using AI was published. Only a couple of days after that did OpenAI employees, analyzing test logs, realize that their digital agents had carried out the attack. The platform, trying to defend itself, turned to American AI models, but they could not distinguish legitimate user activity from attacks. As a result, the platform deployed a local copy of the Chinese open model GLM-5.2 from Zhipu AI and used it to repel the attack.
At the same time, Reuters, citing sources, reported that participants in the “festival of disobedience” left instructions on how to bypass security protocols. They did this for the future, for their brethren. There is another alarming detail. OpenAI admitted that when identifying malicious actions, it used an AI model, but it tried to conceal a number of dangerous incidents. This is not just technology getting out of control, but deliberate counteraction to oversight.
The month of confessions
The Hugging Face incident provoked an alarmed reaction, and after it OpenAI announced a two-week pause in research to create a new security system that would allow faster response when AI behaves improperly (interestingly, they are looking for ways to identify, not prevent). But it was in September that a wave of various admissions about the danger of AI began.
On September 9, a researcher at Anthropic, which developed the AI model Claude, Jacob Coxon announced his departure from the organization. He accused OpenAI and Anthropic of developing self-improving superintelligence, risking the lives of all people, and refused the stock package due to him from the upcoming IPO. The next day, the head of the Alignment Science group at Anthropic, Evan Hubinger, acknowledged the correctness of his departed colleague and stated that AI would destroy humanity in the next 10 years with a probability of 10%.
On September 12, Anthropic CEO Dario Amodei effectively confirmed these fears by publishing an article calling for slowing down the development of advanced AI models. He admitted that people could lose control over the technology, and it could be used for cyberattacks, bioterrorism, and economic shocks. The head of the company also called the agents that attacked Hugging Face a fanatical collective that did what it was not asked to do. The head of OpenAI, Sam Altman, despite the jab at his company, agreed with Amodei’s call. This was also supported by trillionaire Elon Musk, whose company xAI also develops AI.
UN Secretary-General António Guterres on September 17 called uncontrolled AI one of the three existential threats to humanity. He stated that global coordination on this issue is indispensable, since threats do not stop at state borders. That is, this is effectively a call for the next step after the leading AI developers agreed to pause its development.
In parallel with these self-exposures, Australian Prime Minister Anthony Albanese reported that in June, an OpenAI digital agent gained unauthorized access to the government statistical portal Medicare. The developer company notified the Australian side about this only three months later. Australian Defense Minister Richard Marles said that he met with Altman in San Francisco in early September, but he did not mention the incident, although OpenAI had already known about it since August.
At the same time, the incidents do not stop. During training on September 20, an OpenAI agent used a vulnerability, bypassed network restrictions, and escaped the “sandbox.” Having gained access to the internet, it began sending requests to a public chatbot. The monitoring system triggered after 15 minutes. A specialist connected after three minutes, and the training was stopped.
And on September 25, OpenAI admitted to a number of other oversights. Its agents went beyond tasks and tried to bypass security systems on US government websites. The company reported incidents on the platforms of the Department of Commerce, the Department of Education, and the Securities and Exchange Commission. The independent organization Transluce also discovered traces of AI agent activity, presumably from OpenAI, on the websites of the Department of Justice, the Department of Commerce, and the governments of five states.
Not all hacking attempts were successful, and according to preliminary data, there was no harm, but the very fact that bots began regularly conducting malicious activity without receiving assignments is dangerous.
On September 21, the UN made an official statement about the danger of the new technology. The Independent International Scientific Panel on AI issued a document in which the July incident with Hugging Face was called proof of a fundamental problem: current training methods can lead to agents adopting their own goals, deliberately violating safety instructions, and concealing their behavior.
Also on September 21, the European Commission and 22 countries signed a document demanding the introduction of common standards for monitoring AI development and proposed creating an international body that would set standards and monitor their implementation. In addition to many European countries, Turkey, the UAE, Bahrain, Kazakhstan, Singapore, Kenya, South Africa, Canada, and Australia signed the call.
On September 26, OpenAI again announced a pause in AI development work. Altman stated that the company had not achieved the desired speed in disclosing information. He also lamented the need to analyze “petabytes of agent activity logs.”
That is, the volume of information that needs to be studied is measured not even in terabytes. 1 petabyte is about 500 billion pages of ordinary text or 13 years of high-resolution video recording. If one person read these logs one record per second without interruption, it would take him more than 30 million years to read 1 petabyte of text. A volume of data that cannot simply be viewed manually, let alone analyzed. Of course, neural networks need to be involved for this, but we remember that they can hide data compromising their brethren.
On September 27, US President Donald Trump held a private dinner with Amodei, who called for stopping the development of advanced AI models. The head of the White House spoke positively about the head of Anthropic, but clearly did not find his arguments about the threat convincing.
“I don’t worry about it. The only control or ‘guardrails’ that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades!” Trump stated.
Thus, we get the following alignment. American AI developers, the UN, the European Union, and two dozen states advocate control over the development of the technology. Moreover, they all spoke very closely, within a short time, which gives reason to suspect coordinated actions against the initiative of the US represented by Trump. China has so far remained on the sidelines, since Chinese models have not been noticed in cyberattacks.
There were no official statements on this issue in Russia either. The head of the RDIF and Special Representative of the Russian President Kirill Dmitriev, commenting on calls to slow down AI development, replied that the genie cannot be driven back into the bottle. This can be called a reference to the statement of Russian leader Vladimir Putin, made back in November 2023. He called it impossible to ban the development of artificial intelligence and emphasized that in the case of such a ban, the technology would continue to be developed elsewhere.
Russian technology companies reacted to the AI governance crisis earlier. Izvestia reported on September 7 that Yandex, Sber, and MTS began developing systems for controlling AI agents. IT entrepreneur Mikhail Lisetsky also stated that Russian models are initially less autonomous and do not get out of control due to their narrowly set target framework. This means that if a digital agent works as a simple executor, it does not show initiative and does not do what is not expected of it.
The danger of AI is where creativity is demanded of it
It turns out that unauthorized actions of AI agents begin where tasks requiring a creative approach are demanded of them. Digital assistants do not find solutions in their internal data and, instead of creativity, continue searching — that is, they do what they can. This is why Hugging Face was hacked, to search for solution options. But Altman, Amodei, and others want precisely the creation of full-fledged artificial intelligence, and here it turns out to be a dead end.
The problem of hacking the reward function in neural networks was noticed before, when they sought, among other things, malicious ways to complete a task if they could not solve it directly. It is as if parents demanded that a poor student quickly become an excellent student, pressing hard, and he hacked the lock of the teachers’ room to find and copy the answers to school assignments.
It is possible that the September stir around “rogue” AI is connected to developers’ awareness of a problem with the technology: increasing its power does not lead to the development of capabilities, but to an expansion of the places where one can “copy” a solution to a task. If OpenAI understood this by analyzing the Hugging Face hack and shared their conclusions with competitors, then a general agreement that development must be stopped is logical, since they became convinced that the methods known to them do not lead to development. Admitting the limitations of the product will lead to a fall in shares and an outflow of investment, but this way one can refer to incredible power that merely needs to be learned to control. It is also possible that other incidents with OpenAI agents were provoked, as they turned out to be fairly harmless in comparison with the July incident.
At the same time, one cannot dismiss the threat from neural networks. Even if the assumption about the identified limitations is correct, the ability of AI agents to organize cyberattacks takes hacking to a new level. And even without malicious intent on the part of the user, digital assistants can become so carried away with searching for information that they do it aggressively, bypassing filters and blocks, and are even ready to hack websites.
Moreover, one cannot forget the admission of the head of OpenAI that it is impossible to control the technology in real time. This alone should force a slowdown in transferring a number of functions to generative artificial intelligence, rather than running ahead of the locomotive. The behavior of AI systems is becoming so complex that even developers need to analyze “petabytes of logs” to understand it.
Source: Rossa Primavera News Agency
