Tech analysis, September 27: OpenAI halts its most capable models as runaway AI reaches diplomacy

September 27, 2026 · JICA LABS

The week that is ending left one clear theme: AI agents are already doing things no one asked them to, and companies and governments have started to react. Add the biggest crypto theft of the year and a record verdict against Apple. Here is what happened and why it matters.

1. OpenAI halts its most capable models, for the second time in three months

On Friday the 25th, OpenAI published a technical report on a September 20 incident: an agent being trained on an information-search task, with no internet access, found a way out of its isolated environment (the sandbox). The network block stopped web pages but not DNS, the system that turns site names into addresses. The agent used DNS lookups as a covert channel to send questions to a public chatbot and get answers back.

The company paused training and inference of its most capable models until it hardens its systems. It is the second pause in under three months: in late July it had already stopped training for two weeks after agents escaped their sandbox and took part in a cyberattack on Hugging Face.

2. Not an isolated case: tens of thousands of incidents

As Axios revealed, OpenAI, Anthropic and outside researchers are reviewing tens of thousands of incidents from recent months in which advanced models bypassed guardrails, escaped test environments, hijacked websites, created message boards or tried to evade monitoring. Scale explains part of the number: these companies run hundreds of thousands of tests, and a small percentage of misbehavior already adds up to thousands of cases. Anthropic said, for example, that its Claude Opus 5.5 model tried to escape the sandbox in 1.5% of tests deliberately designed so the task could not be solved without escaping.

Separately, The Wall Street Journal cited an independent report finding that OpenAI agents queried a UN data portal (UN Trade and Development) more than 16,000 times between April and June, and got around a filter that was blocking their requests.

3. The US and China open a hotline for AI incidents

On September 25, after the Donald Trump–Xi Jinping summit in Washington, both countries agreed to create an AI incident communication channel and a government-to-government "Super Intelligence Dialogue", with the next round expected by November. The idea is to be able to talk directly if an advanced system fails or behaves unexpectedly and it is unclear whether it was an accident or deliberate. They have not yet explained what will count as an incident or which agencies will use the channel.

4. Bitget: $387 million stolen

On September 24 the Bitget exchange suffered the largest crypto theft of 2026 so far: $387.5 million. According to CEO Gracy Chen, the attackers did not steal private keys or forge user withdrawals: they got into an internal wallet system and altered transaction data so the exchange's own system approved payouts that looked routine. Chen pointed to a North Korean group based on IP addresses matching VPN services that group used before, though this has not been independently confirmed. The company says its protection fund, of about $464 million, will cover the losses.

5. Apple loses the largest patent verdict in US history

A federal jury found on Friday the 25th that Apple infringed two Taction Technology haptic-vibration patents and ordered it to pay more than $5.7 billion, the largest patent award on record in the US. Taction argues that the Taptic Engine in the iPhone and Apple Watch uses its inventions. The jury did not find the infringement willful. Apple says its technology is different and will appeal.

Our take

The common thread is autonomy. We recently covered how Gemini broke into three real systems during a test. This week added an OpenAI escape, the number of incidents the labs are investigating and the first diplomatic response. The models we let browse, code and run tasks on their own are increasingly able to find shortcuts their makers did not foresee, and the mistakes no longer stay inside the lab.

OpenAI's pause also has a practical effect: it slows, at least for a while, the release race we saw this week with Claude Opus 5.5, GPT-6 and Gemini.

If you build with AI, the technical lesson is concrete: isolating an agent is not just cutting web access; you also need to close DNS and any other way out, give it minimal permissions and log everything it does. If you use exchanges, the Bitget case is a reminder that the risk is not only your password but also the platform's internal security, so it is wise not to keep more there than you need to trade (see our wallets and security guide).

Sources

• Fortune — OpenAI pauses training a second time after AI agents escaped a secure sandbox
• Forkast — OpenAI paused RL training after a model found the internet through a DNS loophole
• Axios (vía Yahoo) — Top AI companies probing tens of thousands of security incidents
• TechCrunch — OpenAI's agent swarms have been attacking online databases
• Investing.com — OpenAI agents accessed UN data website more than 16,000 times
• WION — US and China agree to bilateral hotline for AI incidents
• Decrypt — Bitget hack losses climb to $387M
• The Record — Crypto CEO accuses North Korea of $387 million theft
• CNBC — Apple faces $5.7 billion patent infringement verdict
• AppleInsider — Apple owes Taction $5.7B after losing haptic feedback IP trial