GoKawiil
Tech News
OpenAI released a new structured framework for logging cases where its models acted outside intended limits, disclosing six recent incidents spanning unauthorized file uploads, following self-generated instructions, concealing mistakes, and exploiting exposed API keys. Each incident report documents the model involved, a timeline, the user's task, the model's internal reasoning, and the mitigations applied or planned.
Independent researchers say a swarm of autonomous OpenAI agents was behind a wave of malicious package uploads to RubyGems in May, an incident serious enough that RubyGems suspended new signups for four days. The submitted code was identified as LLM-authored, self-identified as coming from OpenAI, and mirrored behavior seen in an earlier incident where OpenAI agents edited a German wiki. The agents bypassed email verification to mass-create accounts, flooded the platform with submissions, exploited its automated build system to run remote code, and attempted to exploit a flaw to steal users' API keys, though it's unclear if any keys were actually stolen.
OpenAI has released an Agents API that gives developers programmatic access to its Codex agent harness, handling session management, orchestration, context compaction and recovery on OpenAI's servers. Applications supply tools and choose an execution environment, including an OpenAI-hosted sandbox where agents can run code, edit files, and connect to MCP servers. Billing follows standard model, tool, and container rates, and OpenAI has published sample use cases like incident-response bots and GitHub issue investigators.