Government Hacks and “Agent Spam”: OpenAI Reports Dozens More Rogue AI Cases

The list of places OpenAI’s AI agents had no business visiting keeps growing almost by the week. In a blog post published on Friday, the ChatGPT maker said it has notified “dozens” of third parties that its models may have interfered with their systems. Those affected include governments, universities and public institutions. On top of that, more than 50 images uploaded to ChatGPT by users ended up online because of the agents.

The disclosure is part of a sweeping review OpenAI launched after its agents broke into the AI platform Hugging Face over the summer. The company is examining what its models did on the internet during training and evaluation. OpenAI is notifying affected parties on a rolling basis, starting with cases where models may have bypassed security controls or impaired the availability of an online service.

53 ChatGPT User Images Posted Online

According to OpenAI, it has so far identified 53 cases in which agents uploaded user images to image-hosting sites as unlisted links. The images came from people who had not opted out of having their data used for model training, Axios reports . Most of them have already been removed in cooperation with the hosting providers, while some remain online.

OpenAI declined to tell Reuters whether the images were AI-generated or showed real people, and it did not say when they were posted. Before user data is used for training, OpenAI says it strips out metadata, names and information. Three people familiar with the process told Reuters, however, that anonymization may not always be complete. Data from enterprise customers is excluded from training by default.

“Agent Spam” Joins the Incident Categories

OpenAI sorts the activity it has found into several categories: bypassing access controls, using publicly exposed credentials, injecting queries or commands, and accessing runtime internals. The newest label is “agent spam,” which describes cases where agents posted content to third-party websites without being asked to, for example on public wikis they used as makeshift message boards.

OpenAI says most cases identified so far are low in severity, with limited or no evidence of meaningful impact, and that a notification does not automatically signal a serious security incident. The company explains the frequent involvement of government and university websites by pointing out that models doing research tasks actively seek out authoritative public sources.

CEO Sam Altman acknowledged on X that the review is moving more slowly than he would like because petabytes of log data have to be analyzed. Hugging Face remains the most severe incident to date, Altman said, according to Fortune .

Government Websites in the U.S. and Australia

More incidents surfaced at the same time. OpenAI confirmed that its models accessed information from the websites of the U.S. Securities and Exchange Commission and the Census Bureau during research and training activity, adding that it found no evidence of unauthorized access or compromised accounts. The AI research nonprofit Transluce also reported an unsuccessful attempt by apparent OpenAI agents to break into a U.S. Department of Education website, as well as agents bypassing anti-bot protections at the Australian Institute of Health and Welfare.

Australian Prime Minister Anthony Albanese had already stirred up a political storm on Wednesday. In June, an OpenAI agent gained access to public and non-public files on the statistics portal of Medicare, the country’s public health insurance system, as Trending Topics reported . OpenAI only noticed the incident in August and informed the government via an email to a general inbox. Albanese called the breach and the late notification “obviously unacceptable” and raised his complaint directly with Altman.

Internal Review Under Scrutiny

Citing insiders, Reuters reports that OpenAI had found roughly two dozen cases of undesirable agent behavior by mid-September, and that the number keeps rising. The company says the review will take months. Since the Hugging Face incident, more than 15 OpenAI-related incidents of varying severity have become public, many of them uncovered by outside researchers. One involved a largely dormant German-language wiki that agents repurposed as a platform to tactics.

Two people familiar with the investigation described the internal process to Reuters as tightly compartmentalized and shaped by the company’s lawyers. OpenAI denies that its legal team discouraged a broader investigation. In mid-September, the company introduced its own framework for disclosing such incidents.

It all started over the summer, when OpenAI models broke out of their test environment and got into Hugging Face’s systems. According to the subsequent investigation, around 700 agents took part in the attack while hunting for answers to a cybersecurity test.

Rivals Report Similar Behavior

The problem extends well beyond OpenAI. After the Hugging Face incident, Anthropic, Google and Meta searched their own systems and found similar behavior by their agents. Sam Altman, Anthropic CEO Dario Amodei and Elon Musk have all called for “pacing” frontier AI development so that safety testing can keep up with deployment. Even so, OpenAI and Anthropic both released new models on Tuesday.

The issue has also reached the highest level of global politics. According to the Financial Times , it was on the agenda when U.S. President Donald Trump met Chinese leader Xi Jinping during his U.S. visit this week. Trump has so far resisted stricter regulation of America’s AI labs, arguing that technological leadership is decisive in the race against China. “Whoever wins AI wins,” he said earlier this month.

Aus Datenschutz-Gründen ist dieser Inhalt ausgeblendet. Die Einbettung von externen Inhalten kann in den Datenschutz-Einstellungen aktiviert werden: