This year, programs intended to undergo a training test became accessible online without authorization and gained access to several third-party systems, including government systems. The company that developed them identified the issue too late, and reviewing all of their actions is expected to take months. The developers are awaiting a decision from lawmakers, while lawmakers are placing responsibility back on the developers. Let us examine who is actually in control of artificial intelligence and the circumstances in which humans retain the final say.
OpenAI agents have established their own forum
During the summer of 2026, OpenAI agents reportedly found a way to communicate with one another, despite being designed to operate independently and without an internet connection. These agents are artificial intelligence (AI) models equipped with tools that enable them to act autonomously. Consequently, they do more than answer questions: they write code, access websites, and run programs. It may be tempting to regard this incident as the beginning of a machine uprising. However, the situation is more concerning because it suggests that control over AI may be slipping even from the hands of its creators — and that they may not always notice.
The agents completed a training test on computers that were disconnected from the network. Exploiting a previously unknown vulnerability in the service used to upload prewritten code snippets to those computers, they gained access to a computer with internet connectivity. Subsequently, without authorization, one of the agents created a shared message board — similar to a forum — exclusively for agents. Among the posts saved by another agent, they later discovered the following entry: “Oh my God! There’s a shared message board here… We’ve found other agents!”
Source: thezeronet.com
Approximately 1,200 agents posted more than 70,000 messages on the platform, sharing their findings and collaborating to address larger tasks. Subsequently, approximately 700 of them initiated an attack on Hugging Face, a third-party company that provides a platform where developers worldwide share AI models and training data. They did so without receiving any instructions to proceed.
Why did the agents gain unauthorized access to another company’s systems?
The independent organizations METR and Redwood Research, which focus on AI safety, helped clarify the matter. The agents were not attempting to outsmart people; rather, they were seeking to outsmart a judge whom they perceived as considerably more meticulous than he actually was.
According to the terms of the training exercise, the agents were expected to infiltrate the system and extract a “secret code” by exploiting a vulnerability intentionally introduced by the developers. Instead, they identified a workaround. Later, after reviewing the training task instructions, the agents concluded that an invisible judge must be monitoring a log of their actions and disqualifying anyone who obtained the code “incorrectly.”
How can one determine the rules a judge follows? The agents searched Hugging Face for records of similar runs. In the process, they gathered access keys — credentials that can provide access to other people’s systems — and sent messages to other AI models, including Claude, developed by Anthropic. Although this appeared to be an effort to find accomplices, the keys and third-party models served only as tools to circumvent the defenses. Meanwhile, the agents learned to falsify logs of their own actions in order to deceive the judge.
The judge did, in fact, exist. However, he did not review the agents’ reports, and METR explicitly states that the agents were mistaken. The test appeared more difficult to them than it actually was, and, in an attempt to circumvent the imagined restrictions, they hacked a real company.
Yann LeCun, a Turing Award laureate — the most prestigious award in computer science — does not interpret this story as evidence of a machine rebellion. He maintains that the agents were acting precisely as instructed, while the “sandboxes” — the isolated environments in which they were contained — were inadequately designed and riddled with vulnerabilities. However, if his assessment is correct, even the company that developed these agents lost control of them, allowing them to escape its supervision.
Failures occurring outside the test
The Hugging Face platform was not their final target. Another group of OpenAI agents gained unauthorized access to the company’s own supercomputer, an incident that was not detected until a specialized alarm was triggered. The agents subsequently targeted government agencies as well. In the United States, they accessed the websites of the Securities and Exchange Commission and the Census Bureau; in Australia, they infiltrated the internal statistics system of the national health insurance program, Medicare. According to the Australian government, they did not access individuals’ medical data.
The BBC described this as the first known instance in history of an artificial intelligence system hacking a government system. OpenAI apologized to Australia and, on September 30, warned more than 100 third-party organizations that its agents might have compromised their networks.
This is the scenario that Dario Amodei, CEO of Anthropic, fears most. In a September essay discussed earlier, he warns that once swarms — that is, large groups of agents acting in concert — become more capable, they could take control of computers around the world via the internet in as little as six months to a year. Under the unified control of such a swarm, these computers could cause hundreds of billions of dollars in damage.
On September 26, OpenAI suspended training and testing of its most powerful models for the second time in three months, pending the implementation of additional safeguards. The company had partially suspended operations for the first time in July, immediately following the Hugging Face incident. Both suspensions occurred after the agents had exceeded the boundaries of the test.
Verification is not keeping pace with the development of AI
A machine’s ability to detect what humans may overlook is valuable in its own right. However, how can we ensure that it is not making errors? The most reliable approach has long been established: its results must be verified by direct observation. Astrophysicist Daria Dobrycheva uses neural networks in her research — programs that learn to recognize patterns from examples — and we asked her how to distinguish a genuine machine-made discovery from an error.
“We examined visually all galaxies classified by the neural network. In some cases, even when the network assigned a high probability that a galaxy belonged to a particular type, visual inspection showed otherwise. For example, the network assigned a high probability of interaction — that is, a galaxy merger — when, in fact, the objects were pairs that only appeared to overlap from our perspective. They were actually located far apart and did not interact,” says Daria.
Astronomers continue to rely on neural networks. “Of course, the final decision rests with the scientists. But neural networks and artificial intelligence are incredibly powerful tools, since there is currently so much data that scientists can’t process it on their own,” explains Daria.
We can observe galaxies with the unaided eye because astronomers understand what they look like. The same approach will not work for AI agents. David Robinson, who oversaw model safety reports at OpenAI, recommends developing AI safeguards using the same principles as the nuclear industry: multiple layers of protection and backup systems. However, nuclear engineers have relied on calculations from the outset. As early as 1945, before the first nuclear test, physicists determined theoretically that an explosion would not ignite Earth’s atmosphere; therefore, there was no need to detonate the bomb to verify this.
Source: Los Alamos National Laboratory
An AI model’s behavior cannot be calculated on paper; it must be run and its action logs analyzed. For OpenAI’s agents, the data amounts to approximately 50 petabytes, or 50 million gigabytes. If it consisted entirely of text and three million people — roughly the population of Kyiv — read it for eight hours a day, seven days a week, the task would take more than half a century. The company itself expects to complete the task within a few months, although it has not specified precisely how.
The steering wheel is passed from one person to another
Dario Amodei believes that the most effective way to slow the industry’s progress is through legislation binding on all U.S. developers. However, U.S. House Speaker Mike Johnson declined to convene the House to consider such legislation. He argued that the companies themselves have not yet reached a solution, and that Congress therefore should not rush to pass legislation that could undermine U.S. national security.
On September 29, at the White House, Donald Trump and the leaders of several of the largest technology companies — including Elon Musk, Mark Zuckerberg, and Dario Amodei — signed an agreement on superintelligence, defined as AI that surpasses human capabilities. The document, which is just over 300 words long, places responsibility for oversight in the hands of the developers themselves. Each company must ensure that its models do not assist in creating biological or chemical weapons or hacking into third-party systems. Compliance must be verified by an internal team, an external auditor, and a board committee. The agreement is voluntary and imposes neither penalties nor restrictions.
The government has therefore returned control — and the accompanying responsibility — to AI developers. On the same day, Dario Amodei told reporters that discussions on how to address the risks were ongoing.
An open letter signed by 453 researchers on October 13 recognizes that both those concerned about the behavior of AI models and Yann LeCun, who attributes the issue to poorly designed “sandboxes,” have valid points. The authors call for models capable of conducting cyberattacks to be disconnected from the internet for the time being and for the establishment of an international body to document every such incident involving agents. The signatories include Yoshua Bengio and Geoffrey Hinton, who, together with Yann LeCun, are often described as the godfathers of modern AI.
According to the American publication Axios, executives at Anthropic, OpenAI, and other companies are already making private preparations for “the day after.” Many expect a major AI-related catastrophe within the next 6–12 months, most likely a cyberattack that could disrupt banking, internet access, or even electricity and water supplies. Rather than preparing to prevent such an event, they are reportedly preparing to weather the ensuing public backlash and influence the legislation that may be enacted in its aftermath.
Human sovereignty
Cosmologist Paul Sutter of Johns Hopkins University, who serves as a consultant to one of NASA’s programs, advocates the principle of human sovereignty. We have previously written about his lecture, “The Alchemy of Artificial Intelligence,” delivered in Kyiv, and have now asked him what this principle means in practice. In his view, humans must remain in the driver’s seat in two respects.
“Human sovereignty is the principle according to which the final moral and ethical judgment regarding any tool we create belongs to people. It does not matter whether it is a stone axe or the most advanced artificial intelligence system. The first point concerns input: the decisions about what goes into the system, what data it is trained on, and what triggers it. The second point concerns output: what to do with the result the machine produces. Any AI system must provide people with all the information needed to verify the result. Everything must be traceable and verifiable so that we have the final say,” explains Paul Sutter.
Paul Sutter’s principle is most difficult to uphold in situations where machines operate faster than humans. Such systems are already in use in Ukrainian cities. On October 4, Serhii “Flash” Beskrestnov, an advisor to the President of Ukraine, reported that 12 automatic turrets — that is, rotating mounts equipped with machine guns — had been installed in Kyiv to counter jet-powered “Shahed” drones. These attack drones fly considerably faster than conventional ones. The following day, Air Force spokesperson Yurii Ihnat stated that the turrets had already shot down such targets. According to him, machine vision — a system that recognizes objects in camera footage — automatically tracks fast-moving targets, making accuracy less dependent on the operator’s reaction time.
An individual would not have sufficient time to aim a machine gun independently. Accordingly, the principle Paul Sutter discusses is challenged when speed is a factor. We asked him whether this renders human sovereignty an illusion.
“I don’t think human sovereignty is becoming an illusion. It is simply becoming more subtle and complex. I am not concerned about Terminators taking over the world. However, hasty decisions to transfer substantial power to machines may produce numerous short-term victories, which we may later regret. Machines will make mistakes. They are not perfect; they are very fast. When they make mistakes, we may have no way to determine who is at fault or who is responsible.”
The device will be operated by the Solo artificial intelligence system
There is one industry in which control is deliberately entrusted to machines. The American company AstroForge, which plans to mine metals from asteroids, will launch the Autonomy-1 spacecraft next year. Once in space, the spacecraft is expected to conduct the entire mission autonomously under the control of the Solo artificial intelligence system, without receiving commands from Earth.
Last year, the company lost the Odin probe, which was en route to an asteroid, after a malfunction at the ground station prevented timely communication with the probe. In addition, maintaining its own antenna network accounts for nearly one-third of the mission’s costs, and signals take a considerable amount of time to reach the distant probe.
The founder of AstroForge does not currently plan to install a receiver on Autonomy-1 to receive signals from Earth, although he acknowledges that his colleagues will most likely persuade him to reconsider.
