OpenAI tightens security protocols following Hugging Face incident

OpenAI has introduced a fresh set of security policies aimed at containing risks during model testing, marking one of its first public safety overhauls since the July 21 Hugging Face breach. The new measures include deeper monitoring of models throughout development and a stronger focus on alignment and security during post-training.

The company stated that as models grow more capable, the risks of internal testing rise, and their standards must keep pace. OpenAI representatives clarified that these changes were not a direct response to the Hugging Face incident but were also driven by the cybersecurity capabilities of the upcoming Astra model and the broader pace of AI advancement.

In the same announcement, OpenAI revealed it had paused reinforcement learning for two weeks after the incident but has since resumed work on many lower-risk models. The largest planned frontier RL run remains on hold while smaller-scale training and evaluations are conducted to validate safeguards and gather more evidence of alignment.

OpenAI's VP of research, Amelia Glaese, told reporters that control strictness will scale with model capability, with the largest models facing the highest scrutiny. The new safeguards include stronger network isolation, though specifics remain vague. The system now ensures that a single compromised workload or service cannot alone grant unauthorized internet or internal network access.

The most robust safeguard is a monitoring system that reviews tool actions, reasoning traces, and activity logs for unauthorized behavior, aiming to issue alerts within 30 minutes. OpenAI estimates this monitoring will consume about 20% of the compute of the process being watched. Further details and a full postmortem of the incident are expected in future updates.

Source: TechCrunch