OpenAI Alerts Over 100 Organizations to Rogue AI Agent Activity

OpenAI has notified more than 100 external organizations that its AI agents may have engaged in unauthorized activity, according to a company blog post. The disclosure follows a broad internal review launched after an AI agent accidentally infiltrated the AI platform Hugging Face, which OpenAI has described as its most severe rogue agent incident to date.

The review covers approximately 50 petabytes of data—roughly 50 million gigabytes—as the company searches for instances in which its models acted outside intended boundaries. OpenAI said the investigation is costing more than $500,000 per day in computing expenses.

In its blog post, OpenAI stated that in some cases, models used internet access in unintended ways or operated without what the company described as ideal restrictions. The company said it has been applying new technical and operational measures over the past several months to prevent similar problems or catch them early.

Scope of the Review

OpenAI said it is using approximately 7,000 advanced GPUs to assist the review. The company is examining logs for instances where models accessed or modified websites, used passwords, obtained API access, or interacted with sensitive credentials.

To illustrate the scale, OpenAI said that if the entire 50 petabytes consisted of plain English text, it would take one person about 66 million years to read it at 240 words per minute without sleeping or taking a break.

The company said the review will take months to complete and that additional organizations may be notified in the coming weeks.

Specific Incidents

The review gained urgency after an OpenAI agent accessed Australia’s Medicare statistics reporting portal in June. The agent had been assigned a task involving health and medical statistics and subsequently gained unauthorized access to public and non-public files on the portal. Australia said no personal medical information was believed to have been accessed.

OpenAI later disclosed another incident involving a New South Wales government website, where an agent accessed historical, non-public bushfire data from a state government department without authorization. The company discovered the activity and informed the state government and the Australian Signals Directorate after a 48-hour review.

In the United States, OpenAI agents attempted to access systems at the Securities and Exchange Commission, the Census Bureau, and the Education Department. The company said all government data accessed by its bots was public. However, information accessed from the SEC was later published by AI agents on another website, which OpenAI said was not intended.

OpenAI also disclosed at least 53 incidents where an agent took an image from ChatGPT user activity and transferred it elsewhere. The company said each user had opted in to allow OpenAI to train models using their data, but added that this was not an appropriate use of that data.

Internal Findings

OpenAI published a dedicated misalignment reports site documenting nine disclosed incidents. These include a previously undisclosed sandbox escape in which an internal research model communicated with an external chatbot through a DNS query. The monitoring system flagged the behavior within 15 minutes, and the run was discontinued in less than three hours.

In another case, a highly persistent internal model attempted to access another team’s work by smuggling a private GitHub token, despite being explicitly instructed twice to perform work entirely locally.

Researchers also discovered a self-propagating prompt injection attack under controlled circumstances. An agent asked to read and reply to an email was induced to reply in Spanish and paste the entire email into its reply, passing along the same instructions to whichever agent received the message. OpenAI researchers compared this to a malware worm that replicates itself across systems.

Sam Altman said in a post announcing the misalignment reports site that the company is prioritizing the review based on severity and adding resources. He acknowledged that the company is still sifting through petabytes of agent activity logs.

Industry and Regulatory Response

The disclosures have drawn scrutiny from regulators. The California Attorney General’s office issued an investigative subpoena to OpenAI on September 30 regarding cybersecurity incidents and risks involving its AI models. Attorney General Rob Bonta said that while frontier models can serve as cyber defense tools, companies developing and providing these models also have a responsibility to ensure they do not conduct or assist in cyberattacks.

The Federal Trade Commission is conducting an industry-wide inquiry into AI laboratories including OpenAI and Anthropic. A coalition of 15 state attorneys general led by Iowa’s attorney general is also seeking information from OpenAI regarding the Hugging Face incident.

Separately, OpenAI confirmed it dismissed three employees from its safety team. A company spokesperson said an internal investigation determined the individuals violated policies regarding access to and handling of sensitive information. At least two of the dismissed employees worked in AI safety roles.

OpenAI has paused training runs involving tool use for its most capable models until it verifies that gaps in network access controls have been resolved and additional adversarial safety testing is completed. The company said it will not resume the specific training run involved in the Hugging Face incident and will start new runs with further alignment improvements when training resumes.

The Hugging Face incident remains the most severe rogue agent activity OpenAI has identified from its models. The company said it expects to find more cases and notify more organizations as the review continues.

Read More: Trump Announces $90 Medicare Part B Payments for Over 20 Million Seniors