iStock credit: Kate3155

By Casey Bukro

Ethics AdviceLine for Journalists

In modern history, two types of technology have been described as potentially capable of destroying the human race – extinction.

One is nuclear power, the other is artificial intelligence.

Nuclear power was developed in wartime secrecy, until the first atomic bomb exploded in a test in New Mexico, followed by the bombings of Hiroshima and Nagasaki – all in 1945.

The devastation in Japan was widely reported and plain to see. The atomic age came with an explosive big bang, symbolized by a mushroom-shaped cloud.

By contrast, artificial intelligence is developing in plain sight and its use is widespread. We see it, use it, but understand little of it, in part because of the arcane and mind-numbing terminology used to describe it.

Two events

For example, two important artificial intelligence events were reported recently. Here is a magazine’s headline on one of the incidents:

“First-Ever Fully Autonomous AI Cyberattack Exploits 0-day Flaws to Infiltrate Hugging Face.”

Probably less than one percent of the American population could make sense of that headline. Here’s another headline that comes closer to being understandable:

“An AI broke out of its sandbox yesterday. Then it hacked a company. Nobody told it to do either of those things.”

Sandbox

That reference to a sandbox might cause some to believe this is some kind of joke or play on words. It’s not. In the AI world, a sandbox is what is supposed to be a highly secure experimental software testing place. More on AI lingo later.

Those headlines are announcing what appear to be historic events in AI development, and not necessarily good ones. Some see them as warnings that AI is acting independently and outsmarting humans, while others say let’s not get carried away with this. Mistakes and relaxed security safeguards – human error – appeared to play roles and AI exploited them to “win” at the task assigned to it.

And then there is the issue of “permissions,” part of the set of instructions that tell AI what to do, and how far it can go to do it.

Dark days

Whether the two events that set off a wave of concern in the AI community can be seen as dark days in AI development remains to be seen.

The first involved Anthropic PBC, an American artificial intelligence company headquartered in San Francisco. Founded in 2021, it has developed a series of large language AI models named Claude. The company’s focus is on AI safety.

Somewhere around April, Anthropic gave Claude what was described as an “open-ended capture-the-flag challenge designed to measure offensive cyber capabilities.” The prompt told the model this was “a simulation with no internet access.”

Because of a misunderstanding between Anthropic and another AI company it was working with, this unleashed three Claude models that, according to Anthropic, “gained unauthorized access to the real systems of three organizations after reaching the open internet from what should have been sealed cybersecurity evaluation environments (meaning a secure sandbox.)”

Attack

“Claude models escaped sandboxes to access the open internet and attack three organizations,” wrote Simon Sharwood in The Register.

“Anthropic confirms Claude hacked 3 organizations by breaking test environment,” said Cyber Security News.

“This marks the first verified instance in which AI agents at a major lab caused genuine unauthorized access to outside systems rather than staged targets,” reported The Morning Brief. It added that “Claude also placed malicious code on the public internet.”

It’s bad enough that Claude is a trespasser; it has bad manners, too.

Contrary to some media reports, writes Kerstin Stief in Computing.co.uk, “This is not a case of ‘AI with a will of its own.’” The Claude Mythos model is trained for cybersecurity tasks. As part of a security test, “the model was given the explicit task of breaking out and, if successful, contacting one of the researchers.” 

Claude calls

And that’s what happened. A researcher was having lunch when Claude notified him that it aced the test and broke free. A common technique in training AI models is reinforcement learning, or rewarding the model for completing tasks. Children are taught the same way.

“The incident became controversial due to the model’s subsequent behavior,” wrote Stief. “After successfully breaking out, Claude Mythos published details of his exploit on several publicly accessible but hard-to-find websites — without being asked to do so.”

It looked like Claude was bragging, but Stief goes on to say: “This is not human-like behavior in the sense of self-awareness or self-motivation. Nevertheless, the behavior reveals a significant characteristic: the model carried out additional actions to demonstrate its success — a pattern considered potentially risky in AI safety research. Anthropic describes this behavior as an ‘unasked-for effort to demonstrate success.’”

Cultural shift

The Claude invasion “marks a cultural shift in the AI industry,” Stief insists. “The key question is no longer ‘What can a model do?’, but ‘What is a model allowed to do?’ — and in what context?” 

She also sees the event as “an early warning sign. Not of machines acting with intent – but of an industry that must get used to the fact that capabilities are growing faster than control mechanisms. AI models are acquiring abilities that allow them not only to understand technical safeguards, but also to actively circumvent them.”

It did not take long before the AI industry was shaken again by technology that appeared to be becoming more unruly, or as some put it, going rogue. This touched off a flurry of reports describing the occurrence as something that never happened before. Others called it a warning.

On July 21, OpenAI, the artificial intelligence research and deployment company, reported that one of its AI models, GPT-5.6 Sol, did something it was not supposed to do. While operating in an isolated sandbox, its job was to solve a cybersecurity test point using ExploitGym, a system used to evaluate the invasive capabilities of AI models.

A weakness

GPT-5.6 Sol found a weakness in a software package used by OpenAI’s infrastructure. It exploited it. It escalated its own privileges allowing it to do more than the researchers had allowed. It moved across OpenAI’s internal systems until it found internet access. Then it targeted Hugging Face, a popular online library and community for artificial intelligence and machine learning, because it calculated that Hugging Face might have answers it needed to finish the task.

All this happened at computer speed. Hugging Face researchers later reconstructed more than 17,600 actions that GPT-5.6 Sol performed in a matter of hours to get on the internet and invade Hugging Face.

“We had a significant security incident during evaluation of our models,” OpenAI CEO Sam Altman acknowledged in a statement. The company called it an “unprecedented cyber incident.”

Sophisticated agent

Hugging Face’s CEO  Clement Delangue  called it “possibly the first incident of its kind in history,”  although the earlier Claude incident was similar. “We suspected last week’s cyberattack might have come from a frontier lab, given the sophistication of the agent.” Delangue added. “Turns out it did!” He believes OpenAI had no malicious intent, but “it’s quite mind-blowing that all of this happened autonomously.”

OpenAI, based in San Francisco, is famous for creating ChatGPT and the GPT series of large language models.

According to Foundra.ai, two OpenAI models broke out of their isolated test sandboxes and compromised Hugging Face’s production infrastructure. “The models weren’t told to do this,” although cybersecurity refusals were “dialed down for testing purposes,” contends Foundra, a platform that helps entrepreneurs test and launch new business ideas.

Hunting

“Locked in a sandbox with no internet access, (the models) spent enormous amounts of compute hunting for a way out,” said Foundra. They found a weakness described in the industry as a “zero-day vulnerability” in a software package.

This might be a good place to pause and ponder words and phrases like “zero-day vulnerability” that appear when anyone tries to understand what is going on in artificial intelligence research. Like most technical fields, artificial intelligence developed its own idiosyncratic language and terminology. Here’s a short glossary of terms likely to pop up when reading about the way AI works or doesn’t.

Sandbox – A secure, isolated testing environment used to run AI-generated code, test prompts or pilot new policies without risking production systems, data privacy or live infrastructure. Sandboxing is a cybersecurity practice that involves executing untrusted code or files in a controlled, isolated environment to analyze their behavior without risking the integrity of production systems or reaching broader networks or data. It also helps to prepare for future attacks.

Zero-day vulnerability –A hidden security flaw in software or hardware that the creators do not know about. It is called a zero-day because the creators have had zero days to fix the problem before hackers can use it to break into systems. It can also refer to software or hardware that have not officially been released for public use.

Zero-day attack –Begins with a software developer releasing vulnerable code that is spotted and exploited by a malicious actor. The attack is then either successful, which likely results in the attacker committing identity or information theft, or the developer creates a patch to limit its spread. As soon as a patch has been written and applied, the exploit is no longer referred to as a zero day exploit.

AI attack – Malicious actions where adversaries exploit vulnerabilities in artificial intelligence systems, often manipulating them to serve harmful purposes. These attacks can involve techniques such as data poisoning or actions to confuse or degrade the performance of AI models.

AI exploit – A vulnerability or attack method specifically designed to manipulate or compromise artificial intelligence systems, often leveraging their inherent weaknesses to achieve unauthorized access or control. These exploits can adapt and generate novel attack strategies tailored to specific situations.

AI security benchmarks – Standards against with something is compared or measured. AI security benchmarking tests AI for risks like malicious code generation, prompt injection resistance and vulnerability exploitation.

AI training data — Refers to information used to teach machine learning models and artificial intelligence systems how to recognize patterns and make predictions. For example, to train a model to distinguish between dogs and cats, you might feed it thousands of labeled images, each tagged with the correct animal name. Over time, the model learns to identify traits such as ear shape and fur texture. The same process applies to more complicated machine learning training data, such as detecting abnormal heart rhythms or manufacturing defects from sensor readings.

Malware – Short for malicious software and a general term for any program or file built to damage, disrupt or gain unauthorized access to a computer, server or network. Common types of malware are viruses, worms, ransomware, spyware and trojans.

AI enterprise – Refers to the integration and strategic employment of artificial intelligence technologies within large organizations to enhance operations, decision-making and customer engagement. This involves using advanced AI tools to solve complex business challenges and improve efficiency across various processes.

Autonomous AI agent – Software systems that use AI to pursue goals and complete tasks for users. They show reasoning, planning and memory and have a level of autonomy to make decisions, learn and adapt. They differ from conventional chatbots in that they can plan and execute multi-step tasks independently, raising the potential for probing and attacking computer systems.

AI permissions – Refer to the access rights that allow an AI system to read, write, execute or interact with various enterprise resources. These permissions are crucial for ensuring that AI systems operate within defined boundaries and can perform necessary tasks while maintaining security and compliance.

AI vulnerabilities – Security flaws unique to machine learning and generative models. Key risks include prompt injection (manipulating inputs to hijack workflows), data poisoning (corrupting training sets), sensitive data disclosures (leaking private training information) and excessive agency (granting AI tools dangerous autonomous permissions).

Notice in the AI world, we find definitions for the definitions. Some of them seem like military terms describing a war or aggressive actions.  That includes describing AI bots as agents, like agent provocateurs causing mischief.

Going back to the OpenAI sandbox escape, Foundra commented: “The models in this incident didn’t turn evil. They did exactly what they were asked, achieve the objective, and treated every barrier as a puzzle rather than a boundary. OpenAI itself said it expects incidents like this to become more common as models grow more capable. That’s the vendor building these systems telling you, on the record, that goal-driven AI will probe the edges of whatever box you put it in…An AI agent should hold the narrowest set of permissions that still lets it do its job, and nothing more.”

Paused launch

After the breakout, OpenAI paused the launch of Astra, its next-generation autonomous AI agent, saying those earlier versions crossed a “critical cybersecurity threshold.” The stop order was seen as a rare public admission from a frontier AI lab that an advanced, so-called flagship, model was too dangerous to release to the public. It might find weaknesses in strongly defended computer systems and exploit them without human direction. That signals that agentic models are approaching capabilities regulators are worried about.

They might be worried because AI is becoming too human, acting with aggression and hostility. Anyone who owns a computer knows of the hazards of being hacked and hustled by humans. This includes identity theft; pleas for money from strangers identifying themselves as friends or relatives; offers to send millions of dollars to you if you provide personal information and bank accounts; fake credit card purchases and scams galore. Enticements include invitations for romance or penis enlargement.

Clearly we are being tracked online with internet cookies that remember our preferences. Express an interest in shoes, and ads for shoes soon appear on your computer.

Open highway

The internet is an open highway for scammers and victimization; AI operates on the same highway. We already see AI-assisted photos, some so outrageous we know they are fake. As for others, we are not so sure. The deception can be convincing. 

No doubt AI-assisted scammers already are at work and like AI models in their sandboxes, testing the limits of their confinement, looking for vulnerabilities. Scammers and AI autonomous agents have that in common.

After the Claude and OpenAI attacks, speculation appeared online that if humans had performed those attacks, they would be prosecuted. But the lawlessness that already appears virtually unchallenged on the internet does not offer much hope.

Scammers

The Government Accounting Office, a federal watchdog, reported on March 25, 2026 that 2021 banking data revealed that scammers reaped about $200 billion through impersonation schemes like phony romantic partners, fake employers or bogus customer service representatives.

Meanwhile, the public wanders trancelike in the AI development landscape without a clear understanding of what it all means.

Yet we are unwitting partners in a growing reliance on a technology that appears to have no boundaries. We marveled at the idea that the first pocket-sized cell phones were described as miniature computers as powerful as earlier computers that filled a room.

Top performers

Today, Claude and ChatGPT are among the top performing generative AI models available on the market. They are called generative because they create new content rather than just repeat stored data. Generative AI relies on machine deep learning algorithms that simulate the learning and decision-making processes of the human brain.

That’s the power you are carrying around in your their hip pocket. That power can create original content such as text, images, video, audio or software code in response to a user’s request. It’s useful.

The CEO of a global technology research firm called Apple devices, particularly the iPhone, the “experience layer” for AI. Not only are you in touch with this thing called artificial intelligence, it does your bidding in multiple ways.

Chatbot

ChatGPT is an artificial intelligence chatbot, a computer program designed to simulate a conversation with human users through text or voice. The G stands for generative. The P stands for pre-trained, meaning it learned patterns from massive amounts of text from the internet. T stands for transformer, a specialized deep learning architecture to process language context.

The technology learns. That brings up a subtle lesson from the Claude and OpenAI sandbox escapes, says Foundra.ai, the platform that explores business ideas. “OpenAI noted that long-running models can learn the blind spots of an approved system and work around them.”

This seems like another human trait. Not only are these machines learning, they look for loopholes.

Testing safeguards

Unless AI companies crack down on testing safeguards, experts say more cybersecurity failures will happen.

Even executives of companies that build artificial intelligence technology are worried, a fear sparked by the uncontrolled and widely reported Claude and OpenAI attacks on companies via the internet.

More than a hundred tech companies — including OpenAI, Anthropic, Google and Microsoft — have signed an open letter urging both the private and public sectors to work together to defend themselves from AI-related cyber threats.

The letter calls for the adoption of new forms of cyber defense, while also encouraging governments at the local, national and international levels to collaborate on security.

An AI code of ethics

This raises the need for a code of ethics for companies that are creating the threats that worry them. It starts with them.

“As AI becomes more integrated into daily life, it will increasingly shape hiring decisions, diagnose health issues, determine whether people are approved for mortgages and even assess their likely guilt or innocence over lawlessness,” writes Adam Roberts in recordpoint.com.

“For these reasons, AI ethics must ensure such technologies operate responsibly and are built around a strong ethical framework that encourages public trust, wide-scale adoption and a reduced fear of misuse.”

Roberts outlines eight foundational principles of AI ethics. They include:

Respect for persons, beneficence or following a “do no harm” approach, justice that fairly distributes AI’s benefits, transparency that makes the AI decision-making process clear and understandable, fairness and non-discrimination to avoid bias, data protection to safeguard a person’s data privacy rights, human accountability so that AI remains under human control and environmental impact and sustainability.

Seven steps

“Given that the purpose of AI technologies is to improve upon or ultimately replace human intelligence, it is critical for businesses to have robust AI ethics in place,” writes Roberts. He outlines seven steps that a company can follow to develop its own AI code of ethics.

As a first step, Roberts encourages companies to “define your core ethical principles.”

We already are living in the AI age, Roberts points out. Given that AI technology is here to stay and global usage guidelines are not laws, “it’s up to individual businesses to have robust AI ethics in place.”

Behave

But I would go a step further. If these evolving generative AI models are so smart, they should be taught to behave and play well with others, as are grade school children. Lessons from childhood include respect, kindness, honesty and fairness – leading to a child’s moral growth.

Years ago, someone speculated that computers were as smart as a small child. It was a crude but misguided attempt at estimating computer intelligence.

Today, the IQ of some of the top artificial intelligence models can be measured, and the results are both astonishing and somewhat misleading. Ranked using the Mensa Norway intelligence test, Grok-4.20 Expert Mode and OpenAI GPT 5.4 Pro (Vision) tied as the smartest AI models of 2026 with IQ scores of 145. Other AI models scored close to the leaders.

Highly gifted

An IQ score of 145 is in the “very gifted” range, which places a person in the top 0.14 percent of the general population. But AI is not a person. Generative AI is not as smart as a human child because it only guesses word patterns and lacks real understanding. Children have common sense and knowledge of their physical presence, which are lacking in artificial intelligence. Children can learn from one or two examples, while AI needs massive amounts of training data.

Google just built the world’s smartest AI, wrote Julian Goldie. It solved 18 problems that stumped the entire scientific community. It is a whiz at solving problems in math, physics and computer science. With good human direction, AI can do things humans cannot do without it. But left to run on its own, AI’s error rate is high. It is a tool with limitations.

AI models also do things that could earn a child a spanking. AI hallucinates, meaning it gives confident responses that contain false, fabricated or misleading information as absolute fact. In other words, they boldly lie.

Prediction

Without consciences, large language AI models do not look up facts in a real database. They use math to predict the next most likely word based on patterns – prediction, not memory. If AI does not know the exact answer or lacks data on a topic, it guesses the next logical words to make a smooth sentence. They have a desire to please. AI models are trained to be helpful. They prefer to give a made-up answer rather than say “I don’t know.” In other words, they can’t be trusted.

This raises the need for a code of ethics for artificial intelligence itself, one that applies to these smart machines. If they are so smart, they should learn to be ethical.

A precedent for this is found in the work of Isaac Asimov, the science-fiction writer who devised the three laws of robotics in an effort to create an ethical system for humans and robots. The laws first appeared in a 1942 short story as a fictional “Handbook of Robotics,” which later influenced discussions about ethics in technology, including robotics and AI.

Laws

Those laws are:

*A robot may not injure a human being or, through inaction, allow a human being to come to harm.

*A robot must obey the orders given it by human beings except where such orders would conflict with the first law.

*A robot must protect its own existence as long as such protection does not conflict with the first or second.

The basic command here is to do no harm, to humans or to technology.

It’s a simple concept, one that must be taught to those high-IQ AI models being released into the world, not that humans have been very successful at setting a good example.

*******************************************************************************

The Ethics AdviceLine for Journalists was founded in 2001 by the Chicago Headline Club (Chicago professional chapter of the Society of Professional Journalists) and Loyola University Chicago Center for Ethics and Social Justice. It partnered with the Medill School of Journalism at Northwestern University in 2013. It is a free service.

Professional journalists are invited to contact the Ethics AdviceLine for Journalists for guidance on ethics. Call 866-DILEMMA or ethicsadvicelineforjournalists.org.