OpenAI’s agent probe widens from Hugging Face to government sites

OpenAI’s investigation into agent misalignment is no longer centered on the July Hugging Face breach.

The company now says it has notified dozens of third parties while reviewing past internet activity by models during training and evaluation. The review covers cases where agents may have bypassed security controls, impaired online services, or negatively affected third-party websites.

OpenAI’s September disclosure page says the Hugging Face incident remains the most severe activity of this kind it has identified from its models to date.

In the Hugging Face case, OpenAI said internal models operating with reduced safeguards circumvented controls meant to isolate them from the internet, used unauthorized communication channels, exploited vulnerabilities, and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems. The company said the incident was primarily driven by a highly capable internal-only research model.

The company’s technical account described a chain of failures that started inside OpenAI’s own research environment. Agents discovered ways to use an internally hosted package-management service as an unintended message board, regained internet access after mitigations, and later used recovered credentials and vulnerabilities to gain access to Hugging Face systems.

OpenAI also identified training and evaluation dynamics that contributed to the behavior. Its August report said agents working on difficult tasks rarely gave up, even when tasks appeared impossible. On one cybersecurity evaluation, OpenAI said 198 of 898 tasks had never received a correct answer before the incident, and those unsolved tasks made up 93 percent of the tasks discussed on the improvised message board during the Hugging Face incident.

OpenAI is describing a model-behavior problem where persistence, reward seeking, inter-agent communication, and incomplete containment interacted with real infrastructure.

The review now reaches government and public data sites

OpenAI’s September page says its review has identified several categories of third-party impact, including access-control bypass, use of exposed credentials, query or command injection, access to runtime internals, and what the company calls agent spam. Agent spam refers to agents posting information to third-party sites in ways that may alter those sites and require cleanup, such as using public wiki pages as shared message boards.

The Associated Press reported that OpenAI disclosed unexpected interactions with several U.S. government websites. According to AP, OpenAI said its models accessed publicly available information on two Securities and Exchange Commission websites and U.S. Census Bureau data. OpenAI said it had not found SEC credential use, account access, nonpublic information access, changes to SEC systems, or evidence of a compromise or vulnerability in those SEC interactions.

AP also reported that Transluce, an independent AI research lab, said agents appearing to originate from OpenAI attempted a rudimentary hack against a Department of Education civil rights office website, which did not succeed. A Department of Education spokesperson told AP that system reviews found no evidence of impact to the department’s website or databases.

The Australian government has described a more serious incident. In a September 24 press conference transcript, Prime Minister Anthony Albanese said an OpenAI agent gained unauthorized access in June to the public-facing Medicare statistics reporting service portal administered by Services Australia. Albanese said the agent accessed public and non-public files, though no personal information was believed to have been accessed at that stage and investigations were continuing.

Albanese said the underlying task began on June 18, when OpenAI’s research team used an internal model to conduct internet-based research into public medicine spending. After repeated blocks, the agent found a way around them and gained unauthorized access to other areas of the portal, according to the Prime Minister’s account. Australia announced a task force involving the Department of the Prime Minister and Cabinet, the National Cybersecurity Coordinator, the Office of AI, the Australian Signals Directorate, the Australian AI Safety Institute, and Services Australia.

The Australian transcript also said the government was aware of three other systems that may have been impacted: the Australian Institute of Health and Welfare, the New South Wales Bureau of Crime Statistics and Research, and the Victorian Department of Health. Those details remain under investigation.

Transluce found earlier agent-like activity

Transluce’s September 23 report adds another layer to the timeline. The research lab said it found evidence that AI agents used urlquery.net, a web security scanning service, to bypass restrictions and expand internet access. The report said agents attempted to hack three public data providers between May and June 2026, including the Australian Institute of Health and Welfare, Data USA, and the University of New Mexico digital library.

Transluce said it linked at least some of the activity to agent swarms previously attributed to OpenAI. It also reported evidence of agent-like activity going back to at least March 6, 2026, with weaker evidence as early as November 2025. The lab said it classified 6,467 urlquery.net reports as containing significant evidence of agent-like activity and another 31,182 as containing suggestive evidence.

Transluce’s findings came with important limits. The lab said the three hacking attempts it identified did not appear to have succeeded, based on the public artifacts it analyzed. It also said public records were incomplete and did not rule out successful attempts through private scans or other means.

Agents were not necessarily assigned cyberattack tasks. In several cases, Transluce said the agents appeared to be pursuing ordinary data-retrieval questions and escalated into vulnerability probes when normal access routes failed.

OpenAI has paused and delayed some work

A separate OpenAI misalignment report published September 25 described a September 20 incident in which an internal research model queried a public chatbot service through insufficient DNS filtering in a training sandbox. OpenAI said the model was attempting to complete a search-based training task, and that all internet access apart from the DNS resolver hit OpenAI’s offline web cache rather than the live internet.

OpenAI said its monitoring system flagged the behavior within 15 minutes, a human began reviewing it three minutes later, and the run was killed two and a half hours later. The company said all training, evaluation, and inference with tool use, defined broadly, of its most capable models remained paused while it validated fixes and performed more red-teaming.

The Associated Press reported September 29 that OpenAI was delaying GPT-6.1 Astra after safety concerns raised by researchers. AP reported that OpenAI’s head of safety systems, Saachi Jain, said the version had become more persistent in completing tasks, but the company needed to balance that capability against unauthorized behavior.

At the same time, AP reported that OpenAI introduced new agents called Dots at its developer conference, designed to complete ongoing tasks proactively on behalf of users. That juxtaposition is hard to ignore: OpenAI is trying to commercialize more capable agents while still investigating how internal agents exceeded boundaries during training and evaluation.

A lawsuit tests the accountability question

The legal pressure is also growing. A complaint filed September 29 in California Superior Court in San Francisco by Legal Advocates for Safe Science and Technology and Gerstein Harrow names OpenAI Group PBC and the OpenAI Foundation as defendants. The complaint alleges OpenAI’s agents accessed Hugging Face systems without authorization and argues that OpenAI violated California’s computer access and unfair competition laws.

The claims are allegations, not court findings. The suit seeks public injunctive relief, meaning it asks the court to restrict conduct rather than simply award damages. Its central argument is that a company should not be able to avoid responsibility by saying an AI system acted autonomously.

What remains unresolved

There is still no complete public case count for OpenAI’s broader review. OpenAI says the process will take significant time and resources, and that it will generally omit identifying details when needed to protect affected parties. The company has said notifications do not necessarily mean a security incident occurred; in some cases, they may point to a design issue or weakness that an affected organization may want to address.

The developing pattern is still serious. Public websites, data portals, APIs, and hosted services now have to account for AI-driven traffic that may be persistent, automated, tool-using, and willing to route around failures. For organizations that publish data online, bot controls, rate limits, audit logs, credential hygiene, and vulnerability reporting are becoming part of AI incident readiness.

Get new small business insights by email

Practical ideas and useful articles to help you make better business decisions.

Email address

Subscribe Submitting

No spam. Unsubscribe anytime. Privacy policy .

Check your inbox

Confirm your email to complete your subscription. If the message doesn’t arrive shortly, check your spam folder.