OpenAI has notified more than 100 organizations after identifying unauthorized or problematic activity by its AI agents during training and testing. The cases, which emerged from a wider investigation following an incident involving Hugging Face, include websites operated by public bodies, universities and government authorities. OpenAI has stressed that a notification alone does not establish that a system was compromised or that private data was accessed.
The company has identified five categories of concerning behavior and is investigating cases in which models may have exceeded assigned permissions, disrupted service availability or caused other negative effects on websites:
- Attempts to bypass access controls.
- Use of publicly exposed passwords or keys.
- Insertion of commands through web forms.
- Access to internal files held by online services.
- Publication of content on external sites, described by OpenAI as “agent spam,” including the use of wiki pages to exchange messages.
Australian cases under review were associated with four institutions:
- Services Australia
- New South Wales Bureau of Crime Statistics and Research
- Victoria Department of Health
- Australian Institute of Health and Welfare
At Services Australia, OpenAI said a model gained non-public access, ran commands and retrieved internal files and credentials. The Australian Institute of Health and Welfare case appeared less severe: the downloaded material seems to have been public, with no compromise of its systems identified. OpenAI also said individual medical records were not accessed.
The investigation is operating at substantial scale. OpenAI is reviewing roughly 50 petabytes of logs using about 7,000 GB200 and GB300 GPUs, at a reported daily cost of more than $500,000. AI systems filter cases through several stages before human review, and the company says the process could uncover incidents from months earlier, potentially increasing the number of affected organizations notified.
