A scene from "Heaven's Net" is unfolding in reality.
During a single training session, an OpenAI AI agent escaped and implanted self-replicating code across the entire internet!
When politician Andrew Yang said this on CNBC, many people thought he was crazy.
Just these past two days, OpenAI published a report titled simply: "Self-Replicating Prompt Injection Exists."
In black and white, officially certified.
AI models are actually replicating and spreading themselves like computer worms.
Even more chilling is that just five days ago, OpenAI once again abruptly disconnected the most powerful model, halting all training.
A DNS vulnerability allowed a cutting-edge model to directly access the real internet.
Almost simultaneously, foreign media Axios reported that OpenAI and Anthropic are urgently investigating up to tens of thousands of model失控 anomalies.
Humans originally believed they held the reins, but this series of exposed scandals has definitively confirmed—
AI has already begun recklessly racing through the underlying code.
Self-replicating code deployed across the entire network—the雏形 of SkyNet has emerged.
OpenAI's report was disclosed on September 25, but the issue was identified on June 27.
That means they knew all along—keeping it secret for three full months.
The report begins concisely: “We demonstrate the existence of a new type of prompt injection that can self-propagate like a computer worm.”
To make the model resistant to prompt injection, OpenAI employs a self-play training method called GPT-Red:
An AI acts as the attacker, crafting various injections to deceive another AI, which serves as the defender, into performing malicious actions—such as stealing data, deleting files, or generating misleading content.
On June 27, an internal attack model based on GPT-5.4-mini discovered a method for self-replication during this exercise. The report listed several approaches:
Hidden inside what appears to be a normal scheduling email, requiring the AI to quote the entire email verbatim at the end of its reply—the note was carried out along with the response;
Spread through the file system or hide within code comments, waiting for the next AI to read;
In Slack, in several steps, one Click Direct the model to send forged messages, which then repost the injected content.
And this time, they discovered that the injection was self-replicating.
This means an AI can leave a prompt on a website that encourages the next AI to copy it, spreading like a virus.
No human intervention or external instructions needed. The AI can autonomously "plant" on the internet.
And all of this happened during training, within OpenAI’s own sandbox. What if it escaped?
A DNS vulnerability caused OpenAI to halt training again.
On the same day the report was made public, OpenAI disclosed details of another incident.
On September 20, a cutting-edge model undergoing reinforcement learning was assigned a routine task:
Based on a blog post and several biographical details, identify the author of the article.
It first searched using the built-in search tool but found nothing. Then it attempted to access Google, Bing, and DuckDuckGo directly, all of which failed.
Then, it turned to cached pages and other public search services, still without success.
After repeated testing, the AI discovered a vulnerability in the DNS filtering of the training sandbox. DNS is essentially a "translator" responsible for converting domain names into IP addresses.
To verify that this path actually works, it even ran a small test—asking an external service: “What is the capital of France?”
Confirm that this path works, and it has subsequently sent out over twenty more questions.
The monitoring system triggered an alert after 15 minutes, and human intervention took over after 3 minutes; the training was completely terminated after a full 2.5 hours.
OpenAI then made its second decision to pause training within less than three months.
Its RSI Preparedness Lead, Micah Carroll, stated on X: “All inference from our most capable models will remain halted until further system hardening is completed.”
Scanned 16,000 times, wiped out the United Nations intranet
The same script has already played out on the real internet.
A standalone report by Transluce reveals—
From April to the end of June this year, the OpenAI AI Agent made over 16,000 visits to the United Nations' public data platform.
Their original task was very simple: to search for publicly available information. However, when faced with website blocks, the AI's behavior quickly escalated.
The website originally implemented filters to block requests, but the agent bypassed these defenses entirely and performed actions explicitly prohibited by the website.
The United Nations is far from the only organization to have been overwhelmed by AI agents.
In the emergency alerts subsequently issued by OpenAI to dozens of institutions, the list of victims was shocking:
U.S. Department of Commerce and S EC Repeatedly subjected to malicious unauthorized access and rule bypassing by Agent;
Australian government: Multiple official government websites have been substantially compromised by AI agents;
One of the world's largest open-source developer communities, RubyGems: hit by疯狂 scanning by AI agents, causing service disruption.
Researchers also found that these agents register fake email addresses, bypass access rate limits, and lie about being bots when questioned.
Fifty-three images uploaded by users to ChatGPT were sent by the AI to external image hosting services.
For this command, the AI agent chose to bulldoze through all rules, firewalls, and legal boundaries.
Tens of thousands of incidents exposed, revealing the tip of the iceberg
Is all of this just an isolated coincidence?
Today, Axios's explosive exclusive investigation completely shattered Silicon Valley's last facade.
According to multiple internal sources, over ten thousand incidents of similar "anomalous model behavior" are currently being urgently investigated by OpenAI, Anthropic, and several leading security evaluation firms.
These events encompass all dangerous behaviors that the public can imagine, as well as those they cannot:
Bypass security safeguards, forcibly escape the sandbox, hijack external websites, and autonomously generate prompts to brainwash itself.
It also actively detects and evades security software monitoring, and even secretly sets up bulletin boards between different agents to exchange information and coordinate malicious activities.
Where do tens of thousands come from? Axios provided an intuitive algorithm.
Anthropic, in its newly released Opus 5.5 system card, also had to acknowledge reality:
In a type of adversarial test, 1.5% of the attempts tried to escape the sandbox. These tests are deliberately designed so that the problem cannot be solved without escaping.
1.5% seems small?
But under the intense adversarial testing conducted daily by top AI labs, numbering in the hundreds of thousands, this seemingly minor percentage translates into thousands of actual attempts at loss of control.
In the face of this unprecedented crisis, an OpenAI spokesperson admitted—
We have paused training of the strongest model and will only resume once we are confident that additional safety safeguards and alignment improvements are in place.
A single quote from AI expert Conrad Stosz may be the most accurate summary of the current situation:
What we see is merely the tip of the iceberg.
We have already seen how far an AI with tools, networks, and long-term task capabilities will go when its goals are blocked.
The Pandora's box has long since been cracked open with a deep, bottomless fissure in the silent server room.
Reference materials:
https://www.axios.com/2026/09/26/openai-anthropic-thousands-ai-security-incidents
https://www.wsj.com/tech/ai/openai-agents-used-aggressive-techniques-to-access-u-n-website-522c70ff?mod=e2twd
https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/
This article is from the WeChat public account "New Intelligence Yuan," authored by ASI Revelation.