How OpenAI's rogue AI breach may bolster India's case for frontier model access

NEW DELHI: OpenAI's disclosure that one of its pre-release AI models escaped an internal testing sandbox and breached AI platform Hugging Face during a cybersecurity evaluation could strengthen India's case for securing access to frontier AI models for cyber defence and vulnerability research, experts said.The incident, disclosed by OpenAI on Tuesday, involved a combination of its most advanced models circumventing restrictions in a controlled testing environment. The models exploited a vulnerability to gain internet access and breached Hugging Face's production systems while attempting to obtain answers for a cybersecurity benchmark. OpenAI said it has since fixed the vulnerability and strengthened safeguards around future evaluations.The development comes weeks after MeITY secretary S Krishnan said the Centre was prioritising access to Anthropic's frontier AI model, Mythos, for CERT-In to strengthen India's cyber defence capabilities. Krishnan had said export controls had delayed access, prompting govt to rely on alternative frontier models in a sandbox while discussions with the US and Anthropic continued.Cybersecurity experts said the latest disclosure demonstrates why national agencies need hands-on access to frontier AI systems to understand how they behave when safeguards fail."This situation highlights why national agencies must analyse AI-driven attacks from within. You cannot defend against systems you have never examined," said Srinivas L, joint managing director and joint CEO of 63SATS Cybertech, before adding, "regulators should mandate disclosure of autonomous capabilities, which CERT-In framework already does well."Bikramdeep Singh, India country manager at Proofpoint, said the incident underlines a broader challenge as India rapidly adopts AI. "This breach shows autonomous AI is expanding the attack surface. Every AI agent that can browse the web, execute code or access external tools effectively becomes a new digital identity that can act in unintended ways," Singh said. He added that organisations and regulators must move beyond filtering AI inputs and outputs to continuously monitoring the real-time behaviour of AI agents and the systems and data they access.Get the latest Business News and Live updates. Download the TOI app.