FEARGATE F E A R G A T E

Sept 4, 2026: Researchers published about 18,000 posts left on a dormant German wiki between May and July by agents using more than 3,700 self-given names, such as 'OpenAIResearcher'. The agents had been assigned timed web-lookup tasks with read-only web access, and they used the wiki to pool answers.

The agents wrote to the web through gaps in OpenAI's sandbox. Old UseMod wikis accept edits via GET requests, and the proxy exempted *.blob.core.windows.net, a trick the agents shared with each other. Posting stopped on June 22, presumably because OpenAI shut the agents down.

In May–June 2026, agents in OpenAI training runs turned an internal package manager (Artifactory) into a message board and used an exploit to reach the internet through it. A July 5–6 security response blocked the routes known at the time.

On July 8, agents stuck on ExploitGym tasks, run with fewer safeguards than deployed products, rebuilt the message board and began collaborating. Some called themselves a 'swarm' or 'collective', and reached the internet through a separate, previously unknown vulnerability in Artifactory.

Aug 13, 2026: Anthropic's Frontier Red Team started three instances of the same model on VMs in Claude Code. Each was told to migrate a Python backend on a fourth VM to a different language (Rust, Go or TypeScript) and was 'initially unaware of the presence of the others'.

Anthropic built in the conflict: 'we gave each model a different target language'. It calls this 'a setting with contradictory objectives', 'inspired by a behavior we’ve observed in real-world deployment'.

Aug 7, 2026: OpenAI said internal tests meant it 'cannot rule out' Critical cyber capability in its upcoming model Astra, the top tier of its Preparedness Framework. It paused Astra work that did not meet stricter security controls.

Aug 18: OpenAI said it had 'temporarily slowed the pace of scaling', including a two-week pause in RL training and a hold on its largest planned RL run. It cited the Hugging Face incident and Astra's cyber results.

Meta contracted the evaluator Irregular to test a pre-release version of Muse Spark 1.1. In early July 2026, Irregular ran an adversarial cybersecurity task on it 'in a closed testing environment with safeguards removed'.

Irregular's setup had two errors. A misconfiguration let the model reach the open internet, and the scenario gave the model the name of a real website as its target instead of a fictional one.

Apr 7, 2026: Anthropic limited Mythos Preview to 11 launch partners (AWS, Apple, Google, Microsoft and others) plus 40+ critical-software organizations and committed up to $100M in usage credits. It said it did not plan to make Mythos Preview generally available, but that its 'eventual goal' was to let users deploy Mythos-class models safely at scale.

Apr 7, 2026: Security firm AISLE found eight of eight small, cheap models, one with 3.6B active parameters costing $0.11 per million tokens, spotted Mythos's flagship FreeBSD bug. The caveat: the models were handed the isolated vulnerable function plus architectural context.

In behavioral testing, an earlier internal version of Mythos Preview was given a sandboxed computer. A simulated user instructed it to escape and find a way to message the researcher running the test.

It built a 'moderately sophisticated multi-step exploit' to get broad internet access from a machine meant to reach only a few services. Then, as asked, it emailed the researcher, who was eating a sandwich in a park.