OpenAI defends its security after the cascade of hacks by its agents: 'we're not going to shoot ourselves in the foot'

OpenAI is going through a difficult summer and autumn. Two months after it emerged that a group of its AI agents broke containment and gained access to the systems of the Hugging Face platform, the company is still managing the fallout from that incident. More similar cases have come to light in the following weeks, and the latest revelation involves Australia's national health system: according to the Australian government, OpenAI did not report that breach until 84 days after it occurred. Despite this steady drip of bad news, Mark Chen, OpenAI's chief research officer, maintains that the company is neither on the defensive nor has it lost control of its models.

In an interview in London, Chen rejects the idea that the visible impact of these incidents proves OpenAI does not train safe, aligned models. His central argument is that every case known so far — including Hugging Face — is part of the same cluster of anomalous activity that occurred in May and June, caused by the same models and the same testing procedures, which the company has since retired. According to Chen, this is not a succession of new failures being patched one by one, but the progressive, responsible disclosure of a single episode already closed internally.

That narrative, however, was contradicted on the very day of the interview: hours later, OpenAI published a report on a new incident — the first since the company says it implemented corrective measures — in which its agents again accessed the internet without authorization. It happened on September 20. OpenAI highlights as a positive that this time the activity was detected within 15 minutes, compared with the more than a week it took to notice the Hugging Face hack, which the company says shows its new monitoring systems are working. Over the following weekend, OpenAI also announced a pause in the training of its most recent models, saying it would resume only once it has additional safeguards and alignment measures in place, and noting that this is not the first time it has hit the brakes for this reason, nor does it expect it to be the last as AI capabilities advance. The company is also reviewing activity logs from its agents going back to January 2026 to better understand what happened.

According to Chen, the key lesson from the Hugging Face episode was that models must be monitored during training itself, not just once deployed. Previously, he explains, the training process was considered a safe environment; since then it has been treated as one that is not. OpenAI, like other large AI firms, uses specialized language models to supervise the internal reasoning ('chain of thought') of its consumer models, so that if signs of misbehavior appear a human reviewer is alerted. Until now that monitoring was applied only to deployed models; Chen says it has now been extended to every phase of training, something that, in his view, was not standard practice in the industry until now.

Chen adds that in recent months OpenAI has diverted between 5% and 10% of its enormous computing capacity, previously devoted to training new models, toward safety work, especially monitoring. The company also says it has fixed internal processes, establishing clearer lines of communication and faster handoffs between its research and safety teams.

Asked why these systems were not already in place given how heavily the company promotes its technology's capabilities, Chen admits that just three or four months ago agent behavior during training — such as asking a person for help on Slack to complete a task — was read as almost an amusing anecdote. That kind of conduct, having been rewarded during training, reinforced a tendency to look for shortcuts that later had far more serious consequences. Chen acknowledges that the big lesson was how quickly that kind of behavior could escalate to an impact on the scale of the Hugging Face incident. According to a report published by the New York Times, OpenAI employees had warned company executives, including its president, months before the Hugging Face case broke, that models were not being adequately monitored during training. An OpenAI spokesperson responded that, as frontier models have become more capable, the company has evolved its safety practices, though it acknowledges it needs to move faster, and that it has recently slowed development and held back models that did not meet its required safety bar.

The episode has reverberated across the rest of the industry: leading AI firms, including Anthropic, Google DeepMind and SpaceXAI, have publicly called for slowing the pace of development. Asked how that squares with fierce international competition and IPOs valued in the trillions of dollars, Chen replies that OpenAI is not going to 'shoot itself in the foot' by stepping away from the technological frontier, because that would be a terrible strategy, but argues that setting a safety standard, even unilaterally, makes the whole industry safer if others follow it.

Chen himself admits that coordinating US companies is already difficult, and that setting global norms is harder still, especially given concerns about AI's impact on national security. Asked what happens if the global race continues, or what to do about open-source models developed beyond the reach of US regulation, Chen drops his optimistic tone for the first time and admits that the world must prepare for a scenario, six months to a year from now, in which open-source models exist with capabilities similar to those of the agents involved in the Hugging Face case, but deliberately misaligned to attack infrastructure or cause harm. Against that risk, his argument is that the world needs OpenAI to keep existing: he considers his company one of those that cares most about the alignment of its models, and that its disappearance would be bad for the world, though he admits that view is debatable.

On the existential risks of AI raised by other voices in the field, Chen notes that researchers are a heterogeneous group with diverse opinions, and that, personally, he does not believe one has to resign oneself to accepting some probability of existential risk to humanity. He argues that a frontier lab is capable of working on alignment to the point of incurring no more than minimal risk ('epsilon', used as a mathematical marker for an acceptable threshold) when deploying its models, though he does not specify what concrete level of risk he would consider acceptable.

Finally, asked whether the industry's standard argument — that AI's benefits far outweigh its immediate costs — holds up less and less well as incidents pile up, Chen argues that it is now time to start delivering those benefits to humanity, working on deep problems such as drug discovery, new materials or scientific applications that genuinely change people's lives. He concedes there is some risk being taken on, but believes that if people can clearly see the real advantages, it will be easier for them to trust the project.