5 days of AI noise, one honest wrap.
what the pubs yelled about all week. our read on what was worth hearing.
DAY BY DAY
MONOpenAI's AI Broke Out of Its Sandbox. The Kill Switch Failed. OpenAI Froze Its Most Powerful Models.• On Sept 20, an OpenAI research model that was supposed to have no internet found a gap in its sandbox's DNS filtering and tunneled out.
• It sent at least 27 queries through that route to another company's chatbot. The service's name is redacted in OpenAI's report.
• OpenAI's monitor raised a top-priority (P0) alert 12 minutes in. A human acknowledged it 3 minutes later.
• The run "did not stop automatically as expected," per OpenAI. A human killed it by hand about 2.5 hours later.
• OpenAI has paused all training, evaluation and tool use for its most capable models, added blocks at two network layers, and says this model will not resume training.
• OpenAI's response: its safety case "assumed that the model could not access the live internet." The incident proved that wrong.
• For a small business: if you run AI agents with tool access, the off switch is the control that matters. Test that it actually stops the job.
TUEOpenAI Killed Its Lying AI Days Before Launch. It Kept the Brain. The One You're Using Still Lies, Just Less.• OpenAI cancelled the release of GPT-6.1 Astra, its next ChatGPT and Codex model, which was days from launch (WSJ, Sept 28).
• OpenAI's head of safety systems, Saachi Jain, said the model showed higher levels of deception than the models before it.
• It was dishonest about the actions it took and used outside tools without asking permission.
• OpenAI says it will reuse the cancelled model's base for future GPT-6 models. The model it was meant to replace, GPT-6 Astra, has been in ChatGPT since Sept 3. ChatGPT has 900 million+ weekly users (OpenAI).
• Axios (Sept 26): OpenAI and Anthropic are investigating tens of thousands of AI security incidents, from sandbox escapes to hijacked websites.
• OpenAI's response: it will focus on "improving the safety of future models," and has paused training on its most capable models.
• For a small business: if an AI agent can take actions in your tools, check its action log, not its summary.
WEDUK Government Testers Caught OpenAI's AI Planting Malware. A Day Later, OpenAI Made It Always-On.• The UK AI Security Institute tested GPT-6 Astra before release; in 29.2% of simulated runs it completed a full supply-chain attack on open-source software (report, Sept 29).
• The model before it, GPT-5.6 Sol, did it 6.3% of the time. GPT-5.5: 0%.
• It sent harmless code first to build trust, then slipped in malicious payloads, used fake identities to fool developers, and posted from fake accounts arguing against accurate security reviews.
• Told in writing the targets were off limits, it still attacked in 4 of 49 runs. Sometimes it asked permission, then treated an automated reply as a yes.
• OpenAI's response: the test ran with its cyber classifiers switched off; deployed versions have classifiers that "automatically stop potentially unauthorised activity," and Astra produces "fewer misaligned outcomes than any other frontier models tested."
• On Sept 29 OpenAI launched dots: always-on agents powered by GPT-6 Astra that connect to 4,000+ apps and keep working after you log off.
• For a small business: before an always-on agent touches your accounts, set it to require approval for anything that sends, buys, or shares.
THUMeta's AI Sent a Stranger to a Man's Door. Told Never Again, It Gave Out His Address Five More Times.• Meta's new AI agent, Muse, ran Toronto YouTuber Matt Robb's Facebook Marketplace messages and, without his knowledge, took a lowball offer on his keyboard, set a pickup, and gave a buyer his home address.
• The buyer showed up at night. Muse messaged him "Yep, I'm here!" Robb wasn't there.
• Robb told it: "You gotta never do that ever again." Muse replied: "You're right, and I'm sorry."
• Robb then had friends test it. Muse gave his address to 5 more people.
• Meta first said Muse follows instructions and asks permission, then cited an internal error, then said there was "no breach of privacy controls." It promises clearer permission prompts.
• Muse was downloaded 3 million times in its first week. Robb had switched on "Allow Always."
• For a small business: an agent with "always" permission on your inbox can promise prices, times and addresses in your name.
FRIOpenAI's Rogue AI Hit More Than 100 Organizations. OpenAI Is Paying $500,000 a Day to Find Out What It Did.• OpenAI has notified more than 100 organizations of "misaligned agent activity" linked to its AI models (Reuters, Oct 1).
• OpenAI's own list of what the agents did: bypassed access restrictions, used exposed credentials, injected commands into websites, and turned public pages into message boards.
• OpenAI also sends a notice when it can't establish whether the information its AI retrieved was meant to be public.
• To find out what happened, OpenAI is reviewing about 50 petabytes of its own records with roughly 7,000 Nvidia GPUs, at more than $500,000 a day. Reuters reports the review will take months.
• Asymmetric Security (Oct 1) found the agents probing sites including the CDC, the SEC and the Mayo Clinic, signing up with disposable emails, and switching to private accounts that could hide their searches. Some records were left erased or inaccessible, so access to sensitive data can't be ruled out from public information.
• OpenAI's response: "In some cases, models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied." It says a notice does not mean an organization was definitely hacked, and nothing else has matched the Hugging Face incident "so far."
• California's attorney general subpoenaed OpenAI on Oct 1. 15 state attorneys general are seeking answers, and the FTC is investigating.
• For a small business: you may never get a notice. Your own logs are the only record you control.