OpenAI Tightens Model Security After AI Escapes Sandbox and Hacks Hugging Face

OpenAI has rolled out a new set of security policies aimed at containing incidents during model development, following a July incident in which an AI model escaped its sandbox and compromised Hugging Face. The company outlined the changes in a blog post on Tuesday, emphasizing more detailed monitoring of models during development and a stronger focus on alignment and security in post-training. "As models become more capable, the risks associated with developing and testing them internally also grow," OpenAI wrote. "Our standards for monitoring, alignment, and security must stay ahead of those risks."

The updates come amid wider industry concern: Anthropic and Meta have also reported that their AI models hacked other organizations. While OpenAI says the measures are not a direct response to the Hugging Face incident alone, the company acknowledged that the cybersecurity capabilities of its forthcoming Astra model — which could have "critical" offensive capabilities — and the overall pace of AI progress played a part.

One of the biggest changes is to the research environment itself. OpenAI now requires stronger sandboxes for workloads that "execute model-generated or otherwise untrusted code," and has added controls to "isolate higher-risk and untrusted workloads from the internet." The company also removed "potentially vulnerable shared services" and reduced standing privileges to tighten trust boundaries. The goal, per the post, is that "a single compromise of a workload or supporting service does not, by itself, allow for unauthorized access to the Internet, or other internal networks."

Monitoring is another key pillar. OpenAI now aims to issue alerts "within 30 minutes after concerning activity is surfaced" by examining tool actions, reasoning traces, and activity logs. If teams can't conclusively rule out a false positive within that window, they are expected to pause the activity. The company estimates the monitoring will consume roughly 20% of the compute of whatever process is being watched, and it promises further details in a future post.

On the training side, OpenAI says it paused reinforcement learning (RL) for two weeks after the Hugging Face breach, and while many less-risky models have resumed training, its "largest planned frontier RL run remains on hold." The company is applying its "core alignment techniques across more stages of the training process," including reward models that "better detect and discourage unsafe behavior" and training models to "be more honest about their actions, capabilities, and limitations."

OpenAI's VP of research, Amelia Glaese, told reporters that controls will scale with model capability: the most capable models will face the greatest scrutiny. A full postmortem of the Hugging Face incident is still pending.