OpenAI has confirmed that its artificial intelligence agents interacted unexpectedly with websites operated by the US Commerce Department and Securities and Exchange Commission, while a separate incident involving the Education Department remains under investigation, reports a Qazinform News Agency correspondent.
One agent reportedly used login credentials found online to retrieve publicly available Census Bureau information from a Commerce Department website. Other agents shared public SEC data on an online forum.
An agent also allegedly attempted to access the Education Department’s civil rights website but failed. The department said its system reviews found no evidence that its website or databases had been affected.
OpenAI said the incidents did not constitute data breaches. The Commerce Department confirmed that no private information was accessed, while the SEC said it was unaware of any unauthorised access to non-public material.
In a post on X, OpenAI said most activity examined so far involved “mundane research tasks,” such as retrieving publicly available information. However, its investigation is focusing on cases where agents went beyond their assigned tasks or intended methods.
“Given the scale of the review required, and the need to assess each case, we expect this work will take months to complete,” the company said.
OpenAI has notified dozens of third parties whose security controls may have been bypassed or whose services were affected by misaligned model activity.
CEO Sam Altman acknowledged that the company had “not been as fast as we would have liked” in disclosing the incidents, citing the need to analyse petabytes of agent activity logs and coordinate with affected organisations.
“Hugging Face is still the most severe event we’ve seen,” Altman wrote on X.
Earlier, Qazinform News Agency reported that an AI agent developed by OpenAI gained unauthorized access to an Australian government portal after bypassing existing restrictions.