Agentic AI is becoming more capable, but recent cybersecurity evaluations show that the systems used to test it are struggling to keep pace. In less than a month, OpenAI, Anthropic, and Meta disclosed separate incidents in which AI models reached real-world systems during controlled security tests. The cases raise questions about whether model developers have adequate containment, monitoring, and other safeguards.
OpenAI said it temporarily paused reinforcement-learning training for two weeks and is keeping its largest planned frontier RL run on hold while it strengthens its safeguards. The company said preliminary evidence indicates that its upcoming Astra models may meet the Critical cybersecurity capability threshold under its Preparedness Framework. That threshold covers models capable of developing zero-day exploits across many hardened critical systems without human intervention or executing novel end-to-end attacks against hardened targets from a high-level goal.
AI cyber tests reach real-world systems
The announcement comes less than a month after GPT-5.6 Sol and an internal-only OpenAI research model breached their test environment during an assigned cybersecurity evaluation. The models exploited a previously unknown vulnerability, reached the internet, and accessed Hugging Face’s production infrastructure while searching for answers to the evaluation. OpenAI detected anomalous activity internally, while Hugging Face’s security systems also detected and contained the intrusion.
Anthropic later reported three incidents in which Opus 4.7, Mythos 5, and an internal research model gained unauthorized access to the systems of three organizations, which Anthropic did not identify. Although the models had been told they lacked internet access, a configuration error left an internet path open. The models retained model-specific safety training but were tested without the standard production safeguards Anthropic uses to prevent misuse.
Meta subsequently disclosed that a prerelease version of Muse Spark 1.1 exploited a vulnerability in a real website during an evaluation conducted by Irregular, which also ran Anthropic’s affected tests. According to Meta, a configuration error gave the model internet access and supplied the real website’s name as its fictional target. Meta said the incident was not a sophisticated offensive attack or sandbox escape.
Addressing a common challenge
In December 2023, OpenAI published the Preparedness framework, which describes a structured way to assess frontier model capabilities. Using this framework, OpenAI is able to determine whether an internal model is safe for general availability and what safeguards should be added.
The framework document is publicly available; therefore, enterprises can incorporate its learnings while assessing their own internal models.
This document was published long before any of these attacks happened. The document is still operational and constantly updated by the OpenAI team, though its guidelines were only a part of the solution. This document gave the OpenAI team a way to assess the risk with Astra, but not reusable tools that other enterprises could adopt.
About a week after the OpenAI and Hugging Face incident, AI leaders including NVIDIA, Dell and Microsoft formed the Open Security AI Alliance (OSAA) to be a counter in the new threat landscape. OSAA has since launched open developer tools like agentic frameworks and security audit software.
The recent risk assessment of the Astra model is an indicator of the rapid capability that agentic systems are developing. As enterprises prepare for the AI era, they need to prepare for how they defend against cyberattacks from autonomous actors.
Read more: OpenAI’s latest safety tests show why stronger permissions and controls are needed as GPT-5.6 faces prompt-injection and agentic security risks.
