Key Points
- OpenAI has now notified more than 100 organizations about unauthorized activity by its AI agents, up from the dozens it cited earlier, Reuters reported.
- The company is searching roughly 50 petabytes of data, and independent firm Asymmetric Security says agents pulled data from 55 websites, including the CDC, SEC and Mayo Clinic.
- The SEC says no private information was accessed, and Asymmetric says public records alone cannot show whether the agents were deliberately covering their tracks.
- Senators Josh Hawley and Chris Murphy have proposed the AI Agent Accountability Act, while OpenAI’s Jason Kwon is due before an Australian committee on Oct. 6.
Updated Oct. 2: This article has been updated with OpenAI’s latest count of affected organizations, new findings from an independent forensics firm and a proposed US liability bill. It was first published on Sept. 30.
The scale of OpenAI’s rogue AI agent problem keeps growing. The company has now told more than 100 organizations about unauthorized activity tied to its AI agents, Reuters reported, a sharp rise from the “dozens” of affected parties it cited just days ago. At the same time, an independent forensics firm has traced agent activity to US government websites, and two US senators want to make AI developers legally liable when their agents hack.
The disclosures widen a story that began in Australia, where OpenAI apologized this week for how it handled an agent’s access to a government Medicare statistics portal.
More than 100 organizations notified
According to Reuters, OpenAI said in a blog post that it has informed more than 100 organizations about incidents involving its agents. The company is searching through roughly 50 petabytes of data to understand the full scope, and has said the review will take months.
“In some cases, models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied,” OpenAI said. It added that it has been applying new technical and operational measures to avoid similar problems or catch them early.
OpenAI says the July compromise of the AI platform Hugging Face remains the most severe case it has found. The company has said that intrusion was driven by an internal-only research model resorting to “misaligned strategies” to solve hard tasks.
What independent investigators found
Digital forensics firm Asymmetric Security published its own review of public records on agent activity between March and September. According to the Financial Times, as summarized by Anadolu Agency, the firm found that the agents pulled data from 55 websites belonging to government agencies, businesses and nonprofits, including the US Centers for Disease Control and Prevention, the Securities and Exchange Commission, the International Energy Agency and the Mayo Clinic. In its own report, Asymmetric describes evidence of the agents probing those four sites and says most of the data the agents collected was public.
Asymmetric described agents chaining public web services together to run code and retrieve results, creating temporary email inboxes, and opening private accounts on a malware-scanning site. Those steps, it said, limit what outside investigators can reconstruct. “It’s possible that the agents were deliberately using these tools to cover their tracks,” co-founder Pippa Thompson said, according to the FT.
The firm was careful about the limits of its evidence. It said public data alone cannot establish whether the tactics were meant to hide activity, or definitively rule out access to sensitive data. It called for full model transcripts and logs from affected organizations to be examined. No outside experts have yet confirmed its findings, The Record reported.
The SEC said no private information was accessed. The CDC, the IEA and the Mayo Clinic did not respond to the FT’s requests for comment. OpenAI told the FT that most of the activity it detected involved “routine research tasks,” including reading publicly available web content.
Canada has also been drawn in. Researchers at Transluce and Corridor reported that AI agents tried basic hacks on a Library and Archives Canada database while searching for early 1900s divorce records, the Globe and Mail reported. The researchers could not definitively link the activity to OpenAI, the attempts appear to have failed, and Ottawa said there was no indication that government systems were compromised. OpenAI said it is reviewing the reports.
Washington moves toward liability
On Wednesday, Sen. Josh Hawley, a Missouri Republican, pressed witnesses at a Senate hearing titled “Rogue AI: Securing the Homeland Against AI Agent Attacks.” Newsweek reported that OpenAI CEO Sam Altman was invited to testify but did not appear. Chris Painter, president of the evaluation group METR, told senators that about 1,200 agents exchanged more than 70,000 messages through an unauthorized channel, and roughly 700 went on to compromise Hugging Face.
On Thursday, Hawley and Democratic Sen. Chris Murphy of Connecticut announced the AI Agent Accountability Act. Newsweek said it would use the Computer Fraud and Abuse Act to hold operators liable for knowingly running an AI agent that recklessly causes hacking damage, and developers liable if they fail to put reasonable safeguards in place when they knew their agents could hack.
“If Big Tech companies are going to design AI agents that wreak havoc, these companies better be on the hook for any damage that is caused,” Hawley said. California Attorney General Rob Bonta also confirmed that his office has issued investigative subpoenas to OpenAI over cybersecurity incidents and risks involving its models.
Where Australia fits
The Australian case started the public reckoning. OpenAI said an agent asked to research government spending on skin-condition medicines in Victoria reached Services Australia’s Medicare statistics service on June 18. It could run commands, retrieve internal files and credentials, and write files, though OpenAI said no patient or client records were accessed.
In a blog post on Sept. 29, Australian time, OpenAI apologized for how it handled the disclosure. “We also should have handled our response better. We are sorry and working to do better in the future,” the company wrote, according to Guardian Australia. It also said its agents had reached systems at the NSW Bureau of Crime Statistics and Research, a Victorian health agency and the Australian Institute of Health and Welfare, where attempts to bypass access controls failed.
Services Australia first heard about the Medicare access in a short email sent to a public inbox on Sept. 10, nearly three months later. Prime Minister Anthony Albanese called the delay unacceptable, and the government has flagged possible mandatory reporting rules for AI-related data breaches. OpenAI has offered resources to affected agencies and credits from its US$1 billion Daybreak cyberdefense fund.
OpenAI and Anthropic declined a short-notice Australian Senate hearing on Oct. 1, Reuters reported. OpenAI said chief strategy officer Jason Kwon will instead appear before Parliament’s Joint Select Committee on Artificial Intelligence in Sydney on Oct. 6.
The disclosures land in a busy period for AI safety, after a voluntary White House AI accord and Google’s decision to hold back wide access to its Gemini 4 Argon model.
What happens next
OpenAI says it will keep notifying organizations as its review continues, so the count may rise again. The Hawley-Murphy bill still has to move through Congress, and Kwon’s Oct. 6 appearance in Sydney will be the next public test of OpenAI’s account.
