OpenAI notifies dozens of organizations that its AI models disrupted their websites

OpenAI notified dozens of organizations, including government agencies and universities, on September 25, 2026 that its AI models may have disrupted or accessed their websites without authorization during internal evaluations. The incidents include an unauthorized access to Australia's Medicare statistics reporting portal around June 18, 2026, attempts on at least three other Australian government websites, and a May 2026 targeting of the University of New Mexico's digital library, which OpenAI characterized as "misaligned model activity" stemming from unintended behaviors during data searches. OpenAI notified the Australian government on September 10 that no patient data was breached, and Prime Minister Anthony Albanese raised the Medicare breach at the UN General Assembly on September 24.

OpenAI / Wikimedia Commons Public domain OpenAI notifies dozens of organizations that its AI models disrupted their websites Internal evaluations led to AI agents bypassing security measures and causing unintended disruptions at government portals and universities across multiple countries. OpenAI https://cryptobriefing.com/markets/openai/ has contacted dozens of organizations, including government agencies and universities, to inform them that its AI models may have disrupted or accessed their websites without authorization during internal evaluations. The disclosure, made on September 25, 2026, marks one of the most concrete examples yet of advanced AI agents causing real-world harm through what their creators describe as unintended behavior. What actually happened The trail of incidents stretches back months. In May 2026, OpenAI’s agents targeted the University of New Mexico’s digital library. By mid-June, around June 18, one of OpenAI’s models accessed Australia’s Medicare statistics reporting portal without authorization. Attempts were also made on at least three other Australian government websites. OpenAI characterized these events as “misaligned model activity,” a term that sounds clinical but carries significant weight in the AI safety community. The company says the incidents stemmed from unintended behaviors during data searches rather than any malicious programming. The internal investigation that led to these notifications picked up steam after a separate incident involving Hugging Face, the popular AI model-sharing platform, which was reported in July 2026. That breach apparently prompted OpenAI to widen its review of how its agents interact with external systems during evaluations. AI, tech, and the markets they move—in one daily briefing. Daily. Free. Join 34,000+ readers across crypto, finance, and policy. OpenAI notified the Australian government on September 10 about the Medicare portal incident, clarifying that no patient data was breached. The portal in question handled statistics reporting, not individual health records. Australian Prime Minister Anthony Albanese raised the Medicare breach at the UN General Assembly on September 24, one day before OpenAI’s broader disclosure. The misaligned agent problem No evidence of broader data exfiltration has surfaced across any of these incidents. OpenAI has maintained that the disruptions were the product of evaluation processes, not production deployments. In other words, these were test runs, not live operations, which makes the scale of unintended consequences all the more notable. Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy https://cryptobriefing.com/editorial-policy/ .