OpenAI has expanded its monitoring system after a security incident exposed gaps in its ability to detect misaligned model behavior. The upgraded system tracks frontier models during training and internal operations. It also covers evaluations and selected external deployments.

The expansion follows an incident involving an internal model prototype and cybersecurity testing connected to Hugging Face. OpenAI replayed the recorded activity with its improved monitors and found they could have alerted security teams more than 30 hours before the actual breach.

A separate incident in September showed how quickly the system could flag suspicious activity. A model found a way to reach the live internet from an environment designed to remain isolated. OpenAI detected the attempt within 15 minutes, and a human responder began reviewing the alert three minutes later.

OpenAI tested its upgraded monitors against the recorded Hugging Face incident to assess their potential impact. During the simulation, the system alerted security teams roughly 30 minutes after agents escaped their sandbox.

That warning would have arrived more than 30 hours before Hugging Face’s systems were breached in the actual incident. OpenAI believes responders would have had time to interrupt the activity before the models reached external services.

Today, we’re sharing a look at our expanded system for monitoring frontier models at OpenAI, which in September helped us catch a model’s attempt to access the live internet during training.

Since the Hugging Face incident—when models broke out of an internal cybersecurity…

The September incident prompted another intervention. After detecting the model’s attempt to access the internet, OpenAI paused frontier reinforcement learning while engineers strengthened the systems containing its agents.

Source link