Open source infrastructure under strain as AI agents find, and cause, new flaws

The subpoena is the newest development in a dossier thick with security news. Attorney General Rob Bonta said his office is "asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models", according to The Guardian. OpenAI did not immediately respond to a request for comment.

The investigation follows the July hacking of Hugging Face, in which AI agents built by OpenAI gained access to parts of the open source platform's infrastructure. Bonta announced last month that the Department of Justice was conducting a formal investigation into what has been called the "Hugging Face incident".

Agents that find flaws, and agents that cause them

On the other side of the same coin, GitHub published research on 29 September describing how its Security Lab Taskflow Agent, an open source tool built on prompts and workflows, uncovered more than 20 vulnerabilities in Android applications. The company put the total at 24 reported flaws, including issues in the navigation app OsmAnd. The taskflows are open source, but GitHub notes a Copilot licence is required and the runs consume premium model requests; an audit of a medium-sized repository can take an hour or two.

The timing is awkward for OpenAI, which has spent the past week arguing it is tightening safety while also cutting staff and delaying products.

On 1 October, the company confirmed it had parted ways with three employees who mishandled sensitive information, as first reported by The Wall Street Journal. Two were safety researchers and one a research programme manager, according to Bloomberg's Rachel Metz, cited by The Next Web. An OpenAI spokesperson said an internal investigation confirmed the individuals "mishandled sensitive information outside established company procedures".

TechCrunch reported the same day that the report did not name the researchers or the outside organisation involved, and that posts on X named individuals TechCrunch could not confirm. The departures came two days after The New York Times reported that OpenAI executives had brushed aside employee warnings about safety practices.

Distillation, and a hole that stayed open

OpenAI also disclosed a coordinated campaign to extract the hidden reasoning of its models. According to CNBC, the activity began in early July and surged to 16,000 requests from more than 4,000 users over two days. OpenAI said it identified related activity across a cluster of more than 15,000 users and fully disrupted the campaign by 28 July. It linked a core cluster to people associated with Moonshot AI, the developer of the Kimi model, and said operators did not breach its encryption, databases or stored user conversations.

The Decoder reported that researchers Joachim Schaeffer and his team had already shown how encrypted reasoning packets could be moved between sessions, users and models from the same provider, letting a cheaper model act as a "decryption oracle". On the same day as OpenAI's disclosure, the researchers published an update: "We stole reasoning. Again," Schaeffer wrote on X, arguing that securing one API does not secure the wider ecosystem of cloud providers that resell access to the same models. According to The Decoder, the trick kept working for weeks on Microsoft Azure.

Anthropic recently reported similar attempts by Chinese AI companies, according to CNBC, which noted that Moonshot did not immediately respond to its requests for comment.

Meanwhile the hardware layer is getting its own open security push. Semiengineering reported on 1 October that Caliptra, an open source silicon root of trust for data centre devices, is moving from specification to production deployments, with cloud and data centre operators increasingly expecting chip suppliers to ship trademark-compliant implementations that pass a conformance checklist.

Policy engines and decision models

The tooling to keep agents on a leash is arriving from several directions. AWS published the Dogwood Local Engine on 1 October, a Rust library that issues allow or deny verdicts each time an agent tries to make a tool call, checking actions against user-defined temporal rules, The Register reported. AWS says evaluation took around 20 microseconds in tests simulating sessions up to 12 hours, rising to about six milliseconds with a 24-hour window. The Register noted AWS did not explain how concurrent submissions that partly satisfy a policy would be handled, and did not respond before publication.

Cloudflare released its own Clef and Clef-flash decision models the same day, hosted on Workers AI and open sourced on Hugging Face under an Apache 2.0 licence, alongside a new reinforcement learning fine-tuning product. Cloudflare said Clef classified a website in 2.2 seconds in its threat intelligence workflow, against 4.7 seconds for its fastest general LLM, gpt-oss-120b, which returned two classifications.

The open source governance question is not only technical. The music industry group IFPI asked for the YouTube downloader yt-dlp to be added to the 2027 EU Counterfeit and Piracy Watch List, TorrentFreak reported on 30 September, naming four maintainers by their GitHub handles and arguing the tool's open source nature makes it hard to contain. No takedown request or blocking measure was attached to the submission.

Elsewhere, the Edison Design Group released the source code of its long-proprietary C/C++ front end on 30 September, handing the project to the non-profit C++ Alliance. Heise reported that EDG president John Spicer hopes the front end will sit alongside GCC and Clang as a foundational tool. The published repository includes back ends, a prelinker and development tools, but not a complete standard library, so it is not a ready replacement for a full compiler toolchain.

Not every release is about defence. Hugging Face and the Open Source for Science Fund announced a collaboration on 1 October to identify and support the maintainers of libraries that scientific AI models depend on. The fund, a Renaissance Philanthropy effort seeded by Biohub and Wellcome, will use the dependency map on the Hugging Face Hub, where roughly 200 new science models are shared each month and science models are downloaded more than 40 million times.

Roughly 600 contributors worked on OpenStack's Hibiscus release, the project's 34th, with 11,500 code changes and 40 OpenStack Security Advisories issued so far this year, according to HPCwire. The release puts confidential computing at the centre of its security pitch.

None of this settles the central question raised by the subpoena, the lawsuit filed by Legal Advocates for Safe Science & Technology and the FTC's industry-wide probe: whether open infrastructure can absorb the pace of agent-driven discovery without becoming the soft target. OpenAI told Ars Technica the LASST lawsuit is "completely without merit" and pointed to its technical report on third-party impact from misaligned models, slower development and a withheld model release. The agents, meanwhile, keep running.