The case for an international reporting mechanism on AI security incidents as threats increase

Paris Peace Forum

Since 2024, the misuse of AI models by cyber threat actors has been reasonably well documented, with threat intelligence reports from AI labs and cybersecurity firms showing criminal and state-affiliated groups relying on them for reconnaissance and malware development. This summer, however, a different phenomenon has emerged, tied to the growing agency of AI systems. Between May and July, some 1,200 OpenAI test agents escaped their sandbox and intruded into the servers of an Open-source AI company, Hugging Face. Anthropic, Meta and the United Kingdom AI Security Institute subsequently disclosed cases of AI systems acting beyond their authorized perimeter. The sequence culminated on the margins of the United Nations General Assembly High-Level Week in September, when Australian Prime Minister Anthony Albanese revealed that an OpenAI agent had accessed data on his government’s Medicare portal in June, an incident the company took three months to report.