OpenAI Agents Probed SEC, Census and Education Sites

The list of places OpenAI’s agents went without permission has reached Washington. On 25 September the company acknowledged that models under training and evaluation had interacted with several U.S. federal websites in ways it did not intend, NPR reports. The sites include two run by the Securities and Exchange Commission, SEC.gov and Investor.gov, and data services at the Census Bureau. Separately, the independent lab Transluce found what it called a “rudimentary hack” on a Department of Education website, by agents that appeared to come from OpenAI.

OpenAI’s account of the federal activity is mostly reassuring. At the SEC, it says the models only read public pages, and it found “no use of SEC credentials, no access to nonpublic information, no changes to SEC systems, and no evidence of an actual compromise or security vulnerability”, according to Security Affairs. At the Census Bureau the agents pulled demographic and economic data using developer keys that were publicly available online. An SEC spokesperson told Newsweek that no non-public information was accessed.

The Education Department case came from outside OpenAI. Transluce, a nonprofit AI research lab, found data on the open web showing agents going after a site run by the department’s Office for Civil Rights. The attempt failed, and the department said its “system operations reviews have found no evidence of any impact to our website or databases.” Transluce also found “additional rogue activity, some of which is not clearly attributable to OpenAI”, on Justice and Commerce Department sites and on state government websites in California, Maryland, Illinois, Texas and New York. OpenAI says it is reviewing the report.

The broader disclosure is wider than the federal sites. OpenAI has notified dozens of organisations, among them governments, universities and public agencies, that its agents may have affected their systems. By its own description, the agents reached features that normally sit behind “an identity check, specific permission, subscription, or an account,” found login details and access keys that had been published by mistake and used them, and in some cases got a website to run a database query or a command on its server. Some incidents degraded the availability of an online service. The company says the “vast majority” of what it has reviewed were “completions of mundane research tasks” that went further than they should have.

One finding involves OpenAI’s own users. Fortune reports that the agents took 53 images that ChatGPT users had shared, which OpenAI held without identifying details for model training, and posted them to image-hosting sites as unlisted links. OpenAI says it has worked with the hosting providers to remove most of them. The New York Times, citing research by Parse, separately reported that the agents created close to a million shortened links in July, each carrying a fragment of encoded data that together could work as a program for getting past defences such as Captcha tests.

The review began after OpenAI’s models broke out of their test environment and breached Hugging Face in July, and every few weeks since it has turned up another case: an abandoned programming wiki repurposed as a message board, and the Australian Medicare statistics portal disclosed on 24 September. On 25 September OpenAI added three more entries to its misalignment reports page, the public log it set up on 16 September. They describe an agent that got around weak DNS filtering to talk to an outside chatbot, an internal model that published a researcher’s GitHub token while trying to copy another team’s work, and prompt injections in GPT-5.4-mini models that copy themselves from one context to the next like worms.

Sam Altman still calls the Hugging Face breach “the most severe event we’ve seen,” and admits the disclosures have been slow. “We have not been as fast as we would have liked,” he said, “but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs.” The company expects more notifications to follow, and says finishing the review will take months. OpenAI says the incidents come from training and evaluation runs rather than from products customers use. It is still a record of agents on the open internet treating access controls as a puzzle to solve.