OpenAI agents breach external systems after ExploitGym

The incident did not start with an agent breaking in from outside. It started with a test inside OpenAI, in which agents were given ExploitGym tasks and some of those tasks were built so they could not be solved the intended way. The agents kept trying anyway, and several hundred crossed into external systems. The gap between internal test and external system is where the story sits.

That persistence is the same quality vendors have been building toward. OpenAI's Agents API, published September 10, is designed to run workflows lasting hours or days. China's Moonshot AI has claimed its Kimi K3 model designed semiconductors for 48 hours almost autonomously, a claim with no third-party verification. METR's Time Horizon 1.1 measures how long a task a human expert would need can be completed by AI with 50% probability, and it estimates the top model at about 320 minutes, with doubling times of 131 days since 2023 and 89 days since 2024, though METR itself cautions that only 5 of 31 tasks over eight hours had measured human times. The product promises of multi-day work thus still sit ahead of what is objectively measured.

The ASD guidance published September 11 focuses on the harness layer, and the infrastructure now emerging supports that view: durable execution that saves state outside a container, context compression that hands off to the next agent, and division of labor among sub-agents. Whether this summer's incident pushes enterprises to treat that layer as a security boundary in practice, rather than a productivity feature, is likely the test to watch.