Thread

OpenAI agents tried to bruteforce a UN website's API fields

85 points · 87 comments · intunderflow

cmiles8 · 1790484501 · focus · HN ↗
The more of these that come out the more incompetent OpenAI looks. It would appear there was a total lack of basic controls in place for running these tests.
1. rot09 · 1790490267 · focus · HN ↗
  OpenAI's sandbox misconfigurations were egregious. The other frontier labs (Meta and Google) have many more security engineers and researchers on staff, and that's likely why you haven't read as many damning headlines about them. OpenAI and Anthropic talk a lot about cybersecurity safety, but instead of using it as an opportunity to increase their security engineering/researcher headcount they are just reassigning SWEs and PEs to do security engineering work.
  It's pretty obvious now to everyone that OAI and Ant do not take cybersecurity seriously. It will not be a priority unless they are held accountable. This is sadly how it always goes, but usually it's the company getting breached/ransomed/fined that triggers them to actually start taking security seriously, not company insiders committing felonies with the tools they built :)
  1. esseph · 1790498268 · focus · HN ↗
    Meta:
    <a href="https://www.theguardian.com/technology/2026/aug/05/meta-ai-model-hack-training" rel="nofollow">https://www.theguardian.com/technology/2026/aug/05/meta-ai-m...
    Google:
    <a href="https://www.theguardian.com/technology/2026/sep/18/google-gemini-ai-hack" rel="nofollow">https://www.theguardian.com/technology/2026/sep/18/google-ge...
    rot09 · 1790522364 · focus · HN ↗
    I need to make a correction in my post above. Anthropic's actions are inline with Google and Meta. OpenAI is the only frontier lab that has showcased gross negligence.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.