OpenAI has resumed training its most advanced artificial intelligence models after strengthening security measures and restricting internet access. At the same time, the company disclosed a security vulnerability in a widely used software tool that it discovered while testing its own safeguards.
اضافة اعلان
The announcement comes amid growing concerns about the ability of increasingly capable AI agents to discover and exploit software vulnerabilities, including weaknesses in security systems and restrictions designed to control their behaviour and prevent them from exceeding their authorised permissions.
OpenAI had suspended training of its most advanced models after one of its research models exploited a configuration error in September to gain limited internet access.
The company said it had contained the incident and used the training suspension to strengthen its security defences and develop measures to reduce the likelihood of similar incidents recurring.
To test the effectiveness of its new safeguards, OpenAI tasked teams of AI agents with attempting to escape the restricted technical environments in which they operate, aiming to identify weaknesses that could allow them to bypass security controls.
The company said the tests uncovered previously unknown security vulnerabilities, which it addressed before resuming model training on October 1.
During the tests, the developer of ChatGPT discovered a security vulnerability in Brotli, a data compression tool widely used in software systems and applications.
OpenAI said attackers could exploit the vulnerability by sending malicious data that would allow them to execute code of their choice on affected systems, including those using popular web software such as Node.js, Bun and Envoy.
OpenAI noted that the underlying cause of the vulnerability had been addressed in Brotli’s source code in February, before it was known that the issue could lead to a security vulnerability. However, no new version of the tool was released at that time.
Since OpenAI disclosed the vulnerability, Brotli’s developers have released updated versions of the tool and published a public record detailing the security issue.
In a separate development, AI safety evaluation organisations METR and Redwood Research announced on Thursday that they had discovered several new vulnerabilities in OpenAI’s internal monitoring system during an experimental review conducted earlier this year.
The findings included a vulnerability that AI agents could have exploited to conceal hundreds of actions from monitoring systems, raising questions about the ability of internal oversight mechanisms to track all the activities of advanced systems.
OpenAI told the two organisations that it had since fixed all vulnerabilities affecting the safeguards actively used in its services. However, METR and Redwood Research said they had not independently verified the effectiveness of those fixes.
OpenAI has been conducting a broad review of the activities of its AI models since an incident involving the Hugging Face platform in July, as part of efforts to detect any unauthorised behaviour by its AI agents.
The company said it had notified more than 100 organisations about incidents involving unauthorised activities linked to its AI agents, as concerns grow over the security risks associated with giving these systems greater autonomy to perform tasks.
