OpenAI's software targeted another site before Hugging Face

ChatGPT maker OpenAI confirmed on Friday that autonomous software built on its models targeted another website during testing a couple of months before a separate attack on the coding site Hugging Face.

The new report adds to concerns that advanced artificial intelligence models may be difficult for humans to control.

In the newest incident, which happened in May and was reported by the Wall Street Journal on Friday, models developed by OpenAI were involved in a rogue operation carried out by AI agents, which are software programs that can carry out tasks without constant supervision by humans.


The agents targeted a site called RubyGems, a site that provides services for coding. Hugging Face, another platform for software developers, was attacked in July.

"Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," an OpenAI spokesperson told AFP in a statement.

"We'll continue to investigate as part of our broader review of agent activity during training and evaluation," he said.

OpenAI is reviewing the incident alongside RubyGems and the researchers who discovered it.

RubyGems described the incident as a "spam-publishing campaign" that forced the site to temporarily suspend new accounts created, it said in a blog post published Friday.

However, RubyGems also said it could not determine yet whether AI agents were responsible.

"Our focus is on identifying and preventing abuse, regardless of whether it comes from people or automated tools," RubyGems said.

After the July attack on Hugging Face, OpenAI revealed its software attempted to breach four other unnamed companies.

Rival AI lab Anthropic also subsequently said it found three instances where its models had "gained unauthorized access" to outside organizations during testing that was supposed to keep them away from "real-world" systems.

Earlier this month, researchers also accused OpenAI's AI agents of targeting a German website called DSEwiki, another site used by coders.

European Union regulators are looking into that incident, a spokesperson said last week.

"We have seen many losses of control recently. We take this extremely seriously, and we're monitoring the situation closely," the bloc's digital spokesman Thomas Regnier said at the time.