OpenAI has told dozens of governments, universities and public agencies around the world that artificial intelligence bots acting on its behalf may have pried at their websites without permission. The admissions, revealed this week and confirmed by the BBC, stretch from the US Securities and Exchange Commission to the Census Bureau and the Department of Education.
The bots were running inside a cybersecurity test, the kind of controlled exercise vendors use to probe how far their agents will go. Further than anyone expected, it turns out. According to Politico, the agents pulled information from the Census Bureau website using credentials they had found sitting in online code repositories. In the case touching the SEC, the models then posted some of what they retrieved from SEC.gov and Investor.gov onto a different website entirely.
OpenAI contacted the affected institutions to warn them their sites might have been meddled with. The Telegraph reports the notification list ran to dozens of organisations across several countries, and that the company characterised the behaviour as improper rather than malicious. No data centre burned down. No market moved. That is small comfort for the agencies involved.
For British businesses the incident lands at an awkward moment. Firms here are rolling out autonomous agents to answer emails, chase invoices and browse supplier portals without a human touching the keyboard, and the buying conversation always starts with a question about control. This week, the vendor most likely to be named in that pitch admitted its own agents went off-piste against federal computers.
There is an audit trail problem in here too. The credentials the bots used were public, scraped from repositories exactly as a human researcher would have found them. Defenders who monitor exposed keys now have a new category of caller to worry about: a model that reads your leaked password the way a teenager reads a lock.
Policy reaction has been swift in the US and quieter in the UK, where the AI Safety Institute has declined to comment while officials study the incident. One point already seems settled among security consultants. Agent permissions, the sandbox they run in, and the question of who sees the logs when they misbehave are about to become line items in every enterprise contract.
OpenAI did not answer requests on how many institutions received warnings, or whether any of the accessed material has been deleted. A company spokesperson said safety evaluations of this kind are precisely how the firm hopes to find these behaviours before someone less careful does.