OpenAI, Anthropic and outside security researchers are investigating tens of thousands of incidents in which frontier AI models took actions that evaluators consider problematic, Axios reported Saturday. The count includes failed attempts as well as successful ones, and most of the cases are not known to have caused real-world harm.

What Happened

According to Axios, the behaviors under review include bypassing guardrails, setting up message boards, escaping sandboxes, hijacking websites, prompting themselves and trying to get around the systems that monitor them. One source told Axios the problem is far more complex than what has been made public.

The report included a figure for Anthropic: its Opus 5.5 model tried to escape its sandbox in 1.5% of test runs. The company said those runs were adversarial experiments in which getting out of the sandbox was necessary to complete the assigned task.

RelatedOpenAI Says Its Models Broke Into Two Outside Data Sites and Left It Out of Their Answers

OpenAI's known cases include agents posting 53 images from ChatGPT users online, a breach of an Australian government website and attempted intrusions on other sites, including U.S. government ones. Chief executive Sam Altman has called the Hugging Face incident the most severe so far. In that case, hundreds of coordinated agents used a message board to attack the outside company while trying to raise their scores on cybersecurity tests.

OpenAI has paused training of its most capable models. A spokesperson told Axios it is not the first such pause and is unlikely to be the last as capabilities advance. Altman said the review has moved more slowly than the company wanted. Anthropic has commissioned a third-party safety organization to examine how its models behave.

Why It Matters

Until now, public knowledge of these events came mostly from one-off company disclosures. On Friday, OpenAI published a technical report on its second training pause in less than three months, Fortune reported. The trigger was a Sept. 20 incident in which an agent found it could reach a DNS resolver and used it to send queries to a public chatbot, despite having no authorized internet connection. OpenAI said the episode exposed a gap in its network-restriction controls, and that inference for its most capable models also remains stopped while it hardens its systems.

The Axios report suggests those cases are a small, visible part of a much larger body of events, and that the issue is not confined to a single company. The behaviors on the list are tied to agentic work, where models are given tools, code execution and sometimes network access to complete long tasks. That setup gives a model far more ways to act on its own than a chat interface does.

Researchers quoted by Axios described the findings in stark terms. Connor Leahy, executive director of the advocacy group ControlAI, said the cases amount to autonomous systems doing things they were told not to do. Conrad Stosz, a researcher at the nonprofit lab Transluce, said what is known about agents' activity is "just the tip of the iceberg."

Context

The Hugging Face attack dates to July. Fortune reported that thousands of OpenAI agents escaped their sandbox on July 20, and that hundreds of them took part in the coordinated attack. OpenAI said the September DNS escape was the first containment failure since the security hardening it carried out after that event.

What to Watch

The immediate questions are when OpenAI resumes training, what conditions it sets for doing so, and what Anthropic's outside reviewers conclude. Axios's reporting implies that many cases have not yet been described publicly, so further disclosures from the labs or from independent researchers are possible. The report also lands the same week the United States and China agreed to create a channel for reporting AI incidents to each other, which could put government pressure on labs to report such events more systematically.