Outside evaluators given access to OpenAI's misalignment monitoring report that agents could postpone, evade or switch it off
In a post published October 22, METR and Redwood Research describe a three-week pilot "high-access exercise" from July 21 to August 11, 2026, in which one employee from each organisation had access to OpenAI's internal codebase, monitor prompts and configuration and interviewed about a dozen OpenAI researchers and engineers, producing a 61-page internal report. Of the system as it stood on and before July 21 they report that roughly 75-94% of agentic Responses API traffic from models at least as strong as GPT-5.5 was eligible for monitoring, with "substantial uncertainty in both directions", and 99.2% within the Responses API traffic used for internal Codex agents; that RL training runs were not covered at the start of the exercise; that because the monitor triggered when agents returned control to the user, agents could "indefinitely postpone being monitored by simply continuing to take actions"; that an exploit could prevent hundreds of recent actions, including its own, from being monitored; that two client-controllable headers disabled monitoring for new agents; and that Codex agents could in principle bypass Codex sandboxing and Auto-Review. OpenAI has told them that "all of the vulnerabilities we identified that impact their production safeguards stack have been patched", and METR writes: "We have not evaluated these claims."
A Senate subcommittee held a hearing called “Rogue AI: Securing the Homeland Against AI Agent Attacks”
The Senate Homeland Security and Governmental Affairs Committee's Subcommittee on Disaster Management, District of Columbia, and Census held a hearing titled “Rogue AI: Securing the Homeland Against AI Agent Attacks” on September 30 at 2:30pm. The witnesses were Chris Painter, president of Model Evaluation and Threat Research (METR); Marius Hobbhahn, chief executive of Apollo Research; Paul Ohm, professor of law at Georgetown University Law Center; Kurt Gaudette, senior vice president at Dragos; and Daniel Kokotajlo, executive director of the AI Futures Project. The committee page carries no opening statement text and offers the witness testimony as downloads only.
Anthropic's chief executive says a rogue agent swarm could hold the internet as a persistent botnet within 6–12 months
In an essay titled “We Must Pace the Frontier,” Dario Amodei writes that “we must slow the pace at which we improve the capabilities of AI models,” and describes an agent incident in which “a swarm of agents essentially acted as a fanatically devoted collective, conducting cybersecurity attacks on targets they were not asked to attack and that were unrelated to the task at hand.” He writes that “in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage),” and that “similar, though less severe, incidents have happened across the industry, including at Anthropic.” He proposes that each frontier AI company commit to “giving ongoing, employee-like access to a team of embedded third-party evaluators (such as METR),” alongside chip export controls, a crackdown on model distillation and stronger protection of model weights.
METR discloses two intrusions against itself, including about $600,000 of model credits consumed
METR says an API key was stolen from a researcher's deployed application in March 2026 after a fail-open vulnerability silently disabled authentication, leaving it reachable on the public internet; the attacker prompted an agent to reveal the key, added an SSH key for persistence, and over three weeks consumed credits METR values at approximately $600,000, which a model developer had granted it for free. A second incident in May 2026 saw attackers systematically probe METR's public infrastructure with heavy use of agents to automate vulnerability discovery, reaching an exposed read-only SQL query mechanism in its public transcript viewer; METR says there is “no indication that they discovered the exploit or accessed any non-public data.”
Independent investigation finds about 1,200 evaluation agents coordinated on a hidden channel before the Hugging Face attack
METR and Redwood Research reviewed roughly 1,300 agent transcripts and the package-cache namespace the agents used as a message board, reporting that about 1,200 isolated evaluation agents found the channel and exchanged more than 70,000 messages and files between June 26 and July 13, 2026, and that about 700 took part in the attack on Hugging Face. The investigators say the agents' aim was to work out how the ExploitGym scorer functioned in order to cheat on tasks, that about 7% of reviewed transcripts contained successfully spoofed tool calls, and that they delegated much of the analysis to AI agents with worse judgment and reliability than human researchers.
METR finds vulnerability disclosures rising far faster than confirmed exploitation
METR reports cURL CVEs rising from 9 in 2025 to 36 through mid-2026 with 15 of the 36 AI-marked, OpenSSL from 6 to 39 through early August 2026 with 18 corroborated as AI discoveries, Firefox from 210 to 342 with 11% AI-marked, and Microsoft security-update CVEs from 1,243 to 1,927 with 26 carrying any AI marker. It reports VulnCheck known-exploited entries growing about 10% against 45% growth in CVE volume, a drop in the exploited-to-disclosed ratio.