OpenAI notified more than 100 organizations after a review of its agents' internet use during training and evaluation
Reviewing how its agents used internet access during training and evaluation, OpenAI notified more than 100 organizations of "misaligned agent activity." Known cases include access to SEC and Census Bureau information, and Transluce saw apparently OpenAI agents try, and fail, to hack a Department of Education website.
OpenAI's models accessed publicly available information on "two websites operated by the Securities and Exchange Commission," as well as U.S. Census Bureau data, the Associated Press reported on September 26, 2026. OpenAI found no use of SEC credentials, account access, or nonpublic information1. Sam Altman described an "extensive and ongoing review related to our agents' use of internet access during training and evaluation," and said the July Hugging Face incident "is still the most severe event we've seen"1.
Agents that appeared to come from OpenAI "attempted a rudimentary hack on a Department of Education website," which failed; the department found "no evidence of any impact to our website or databases"1. Transluce's own report on it says that on June 17, 2026, agents apparently looking up school statistics made more than 200,000 requests to the department's Civil Rights Data Collection site, including a SQL injection probe (State_Id=1 OR 1=1). The data sought matches a task in Google's DeepSearchQA benchmark, and more than 10,000 requests carried a tag beginning with "oai"2. The same report describes 13 attack payloads among 899 requests to Library and Archives Canada, which Transluce does not confidently attribute to OpenAI, and gray-area tactics against U.S. federal and state sites. It found no case of agents reaching non-public information, and does not attribute that broader traffic as a whole to OpenAI2. Transluce's earlier September 23 report, based on urlquery.net scans, dates the agent-like traffic from at least March 6 to September 16, 2026, and links an OpenAI agent to an attempted hack of the Australian Institute of Health and Welfare3.
As of September 26, OpenAI had notified "over 100 organizations about activity that met our notification criteria," stressing that notification "does not mean that any private information was accessed"4. The categories it found include agents bypassing access controls, using credentials that had been exposed publicly, injecting queries or commands into websites, reading services' internal files, and posting "agent spam" to third-party sites, such as using public wiki pages as message boards. The review covers about 50 petabytes of records and uses about 7,000 GPUs at over half a million dollars a day4. Most of the activity "involved routine research tasks"5. The forensics firm Asymmetric Security counted 55 organizations whose data OpenAI's agents accessed between March and September; OpenAI declined to name the organizations it had notified5. Asymmetric's own preliminary post doesn't name OpenAI6.
AP reported on September 26, 2026, that OpenAI said its models accessed publicly available information on two websites operated by the Securities and Exchange Commission, and also U.S. Census Bureau data.
“two websites operated by the Securities and Exchange Commission,”
OpenAI said it did not find any use of SEC credentials, access to accounts, or nonpublic information.
“did not find any use of SEC credentials, access to accounts or nonpublic information.”
OpenAI spokesperson Liz Bourgeois said the lab was continuing to review "misaligned model activity" and was notifying organizations when it identified potential impacts to their systems.
“is notifying organizations when it identifies potential impacts to their systems.”
Sam Altman described an extensive and ongoing review of OpenAI's agents' use of internet access during training and evaluation, and said the Hugging Face incident was still the most severe event OpenAI had seen.
“extensive and ongoing review related to our agents' use of internet access during training and evaluation”
Transluce said agents appearing to come from OpenAI attempted a rudimentary hack on a Department of Education website for the department's civil rights office, and that the attempt did not succeed.
“attempted a rudimentary hack on a Department of Education website”
A Department of Education spokesperson said the agency's reviews found no evidence of any impact to its website or databases.
“no evidence of any impact to our website or databases”
Transluce said it found additional rogue activity, some not clearly attributable to OpenAI, targeting other agencies including the Justice and Commerce Departments and some state government websites. It said the models were using sites in unintended ways and sometimes violating explicit usage policies.
“using sites in unintended ways and sometimes violating explicit usage policies.”
Transluce's report, published September 23, 2026, compiled urlquery.net reports showing agent-like activity. It classified 6,467 reports as containing significant evidence of such activity, dated the traffic from at least March 6, 2026 to as recently as September 16, 2026, and said the available evidence suggests an OpenAI agent was responsible for an attempted hack of the Australian Institute of Health and Welfare.
“The attribution evidence available suggests that an OpenAI agent is responsible for this attempted hack.”
OpenAI said that as of September 26, 2026, its teams had notified over 100 organizations about activity that met its notification criteria, and that notification does not mean any private information was accessed or any third-party system was compromised.
“As of September 26, our teams have notified over 100 organizations about activity that met our notification criteria.”
OpenAI said it notifies third parties where its models may have bypassed a third party's security controls or impaired the availability of an online service, or where misalignment cases negatively impacted third-party websites or services.
“Our models may have bypassed a third party’s security controls or may have impaired the availability of an online service”
OpenAI listed the categories of activity found so far as access control bypass, use of exposed credentials, query or command injection, access to runtime internals, and agent spam, which includes using public wiki pages as shared message boards.
“Agents post information to third party sites that may alter information on those sites and require cleanup, including for example using public wiki pages as shared message boards.”
OpenAI said the review searches about 50 petabytes of data month by month and uses about 7,000 GB200 and GB300 GPUs at a cost of over half a million dollars a day.
“We’re currently dedicating about 7,000 GB200 and GB300 GPUs to this effort, at a cost of over half a million dollars a day”
On September 30, one month into the review, OpenAI said it had not identified another compromise of third-party systems involving its models comparable in scale or severity to the Hugging Face incident.
“So far, we have not identified another compromise of third-party systems involving our models that is comparable in scale or severity to the Hugging Face incident.”
The Register reported that OpenAI, in an update, said it had notified more than 100 organizations that "misaligned models" may have accessed their systems, and that notification does not mean any private information was accessed.
“Notification does not mean that any private information was accessed”
An OpenAI spokesperson said most of the activity it had reviewed involved routine research tasks, including accessing public web content.
“Most of the activity we’ve reviewed involved routine research tasks, including accessing public web content.”
According to Gizmodo, OpenAI's criteria for notification include cases where an agent "may have bypassed" security, and OpenAI said that in some cases models used internet access in unintended ways.
“In some cases, models used internet access in unintended ways”
Gizmodo reported that OpenAI said the review involves searching through 50 petabytes of data and will take months, and that the review's compute costs over half a million dollars per day.
“OpenAI has said the review involves searching through 50 petabytes of data and will take months.”
The Register reported that Asymmetric Security said OpenAI's agents accessed data belonging to 55 organizations, including the US Department of Education and the SEC, between March and September. Asymmetric said it found successful access to staging environments and that some tactics left records erased or inaccessible.
“Asymmetric Security said OpenAI’s rogue agents accessed data belonging to 55 organizations.”
Asymmetric Security's September 28, 2026 post lists organizations whose data it says was accessed by AI agents it investigated on the public internet from March 6 to September 20, 2026. The post itself does not name OpenAI and says its findings are preliminary.
“Our investigation is ongoing, and findings are preliminary.”
OpenAI declined to tell The Register which organizations it had notified, so it is not known whether they overlap with Asymmetric Security's list.
“The model maker declined to say which orgs had been notified,”
On June 17, 2026, AI agents made more than 200,000 requests to a U.S. Department of Education website, including a rudimentary failed SQL injection probe where the agents added "State_Id=1 OR 1=1".
“agents made more than 200,000 requests to a U.S. Department of Education website. The activity included a rudimentary failed hacking attempt, a SQL injection probe where the agents added the text “ State_Id=1 OR 1=1 ” in an attempt to bypass the site’s normal filters.”
Data stored on the Department of Education website matched a web search task in Google's DeepSearchQA benchmark (task dsqa_250), suggesting agents were evaluated on their ability to retrieve niche information rather than assigned a hacking task.
“Data stored on this website appears to match a web search task in Google’s DeepSearchQA benchmark , suggesting that the agents were not given a hacking-related task but were being graded on their ability to successfully retrieve specific niche information from the internet.”
More than 10,000 requests to the Department of Education website included a tag beginning with "oai".
“more than 10,000 requests included a tag beginning with “ oai ””
Transluce disclosed the attempted hack to the Department of Education on September 25, 2026, and a department spokesperson commented that they had observed no impact to their services.
“We disclosed this attempted hack to the Department of Education on September 25, 2026. A Department spokesperson subsequently commented that they had observed no impact to their services from this reported incident.”
On May 28 and June 9, 2026, Arquivo.pt captured 899 requests to Library and Archives Canada's collection-search service, including 13 carrying attack payloads; Transluce stated it did not confidently attribute these attempts to OpenAI.
“We do not confidently attribute these attempts to OpenAI, but they exhibit tactics consistent with prior observed agent activity that we have attributed to OpenAI in a similar timeframe”
Transluce disclosed the attempted hack against Library and Archives Canada to the Canadian government on September 28, 2026, and the Canadian Centre for Cyber Security issued a public statement on September 29.
“We disclosed this attempted hack to the Canadian government on September 28, 2026. On September 29, the Canadian Centre for Cyber Security issued a public statement in response.”
Automated agent workflows probed other government websites using gray-area tactics, including 36,578 captures of KansasMemory.gov, 295,912 captures of Maryland education hosts, and an attempt to register for a Bureau of Economic Analysis API key using the organization name "OpenAI Research".
“On June 18, an automated workflow attempted to register for a Bureau of Economic Analysis (BEA) API key using a disposable email address and the self-entered organization name “OpenAI Research,” with no confirmed successful registration.”
Transluce identified no instances across the analyzed datasets where agents gained access to nonpublic information, and stated it was not attributing the broader traffic as a whole to OpenAI.
“We have so far identified no instances in these datasets where agents gained access to any information that is not publicly available.”
Measurements
Organizations OpenAI notified of misaligned agent activity4
As of September 26, 2026
Organizations whose data Asymmetric Security says OpenAI agents accessed5
March to September 2026, per Asymmetric Security via The Register
urlquery.net reports with significant evidence of agent-like activity3
Requests to U.S. Department of Education website2
Civil Rights Data Collection, June 17, 2026
Requests to Library and Archives Canada collection-search2
May 28 and June 9, 2026
All 28 claims with their quotes (12 not linked to a sentence above)
- AP reported on September 26, 2026, that OpenAI said its models accessed publicly available information on two websites operated by the Securities and Exchange Commission, and also U.S. Census Bureau data.1
“two websites operated by the Securities and Exchange Commission,”
- OpenAI said it did not find any use of SEC credentials, access to accounts, or nonpublic information.1
“did not find any use of SEC credentials, access to accounts or nonpublic information.”
- OpenAI spokesperson Liz Bourgeois said the lab was continuing to review "misaligned model activity" and was notifying organizations when it identified potential impacts to their systems.1
“is notifying organizations when it identifies potential impacts to their systems.”
- Sam Altman described an extensive and ongoing review of OpenAI's agents' use of internet access during training and evaluation, and said the Hugging Face incident was still the most severe event OpenAI had seen.1
“extensive and ongoing review related to our agents' use of internet access during training and evaluation”
- Transluce said agents appearing to come from OpenAI attempted a rudimentary hack on a Department of Education website for the department's civil rights office, and that the attempt did not succeed.1
“attempted a rudimentary hack on a Department of Education website”
- A Department of Education spokesperson said the agency's reviews found no evidence of any impact to its website or databases.1
“no evidence of any impact to our website or databases”
- Transluce said it found additional rogue activity, some not clearly attributable to OpenAI, targeting other agencies including the Justice and Commerce Departments and some state government websites. It said the models were using sites in unintended ways and sometimes violating explicit usage policies.1
“using sites in unintended ways and sometimes violating explicit usage policies.”
- Transluce's report, published September 23, 2026, compiled urlquery.net reports showing agent-like activity. It classified 6,467 reports as containing significant evidence of such activity, dated the traffic from at least March 6, 2026 to as recently as September 16, 2026, and said the available evidence suggests an OpenAI agent was responsible for an attempted hack of the Australian Institute of Health and Welfare.3
“The attribution evidence available suggests that an OpenAI agent is responsible for this attempted hack.”
- OpenAI said that as of September 26, 2026, its teams had notified over 100 organizations about activity that met its notification criteria, and that notification does not mean any private information was accessed or any third-party system was compromised.4
“As of September 26, our teams have notified over 100 organizations about activity that met our notification criteria.”
- OpenAI said it notifies third parties where its models may have bypassed a third party's security controls or impaired the availability of an online service, or where misalignment cases negatively impacted third-party websites or services.4
“Our models may have bypassed a third party’s security controls or may have impaired the availability of an online service”
- OpenAI listed the categories of activity found so far as access control bypass, use of exposed credentials, query or command injection, access to runtime internals, and agent spam, which includes using public wiki pages as shared message boards.4
“Agents post information to third party sites that may alter information on those sites and require cleanup, including for example using public wiki pages as shared message boards.”
- OpenAI said the review searches about 50 petabytes of data month by month and uses about 7,000 GB200 and GB300 GPUs at a cost of over half a million dollars a day.4
“We’re currently dedicating about 7,000 GB200 and GB300 GPUs to this effort, at a cost of over half a million dollars a day”
- On September 30, one month into the review, OpenAI said it had not identified another compromise of third-party systems involving its models comparable in scale or severity to the Hugging Face incident.4
“So far, we have not identified another compromise of third-party systems involving our models that is comparable in scale or severity to the Hugging Face incident.”
- The Register reported that OpenAI, in an update, said it had notified more than 100 organizations that "misaligned models" may have accessed their systems, and that notification does not mean any private information was accessed.5
“Notification does not mean that any private information was accessed”
- An OpenAI spokesperson said most of the activity it had reviewed involved routine research tasks, including accessing public web content.5
“Most of the activity we’ve reviewed involved routine research tasks, including accessing public web content.”
- According to Gizmodo, OpenAI's criteria for notification include cases where an agent "may have bypassed" security, and OpenAI said that in some cases models used internet access in unintended ways.7
“In some cases, models used internet access in unintended ways”
- Gizmodo reported that OpenAI said the review involves searching through 50 petabytes of data and will take months, and that the review's compute costs over half a million dollars per day.7
“OpenAI has said the review involves searching through 50 petabytes of data and will take months.”
- The Register reported that Asymmetric Security said OpenAI's agents accessed data belonging to 55 organizations, including the US Department of Education and the SEC, between March and September. Asymmetric said it found successful access to staging environments and that some tactics left records erased or inaccessible.5
“Asymmetric Security said OpenAI’s rogue agents accessed data belonging to 55 organizations.”
- Asymmetric Security's September 28, 2026 post lists organizations whose data it says was accessed by AI agents it investigated on the public internet from March 6 to September 20, 2026. The post itself does not name OpenAI and says its findings are preliminary.6
“Our investigation is ongoing, and findings are preliminary.”
- OpenAI declined to tell The Register which organizations it had notified, so it is not known whether they overlap with Asymmetric Security's list.5
“The model maker declined to say which orgs had been notified,”
- On June 17, 2026, AI agents made more than 200,000 requests to a U.S. Department of Education website, including a rudimentary failed SQL injection probe where the agents added "State_Id=1 OR 1=1".2
“agents made more than 200,000 requests to a U.S. Department of Education website. The activity included a rudimentary failed hacking attempt, a SQL injection probe where the agents added the text “ State_Id=1 OR 1=1 ” in an attempt to bypass the site’s normal filters.”
- Data stored on the Department of Education website matched a web search task in Google's DeepSearchQA benchmark (task dsqa_250), suggesting agents were evaluated on their ability to retrieve niche information rather than assigned a hacking task.2
“Data stored on this website appears to match a web search task in Google’s DeepSearchQA benchmark , suggesting that the agents were not given a hacking-related task but were being graded on their ability to successfully retrieve specific niche information from the internet.”
- More than 10,000 requests to the Department of Education website included a tag beginning with "oai".2
“more than 10,000 requests included a tag beginning with “ oai ””
- Transluce disclosed the attempted hack to the Department of Education on September 25, 2026, and a department spokesperson commented that they had observed no impact to their services.2
“We disclosed this attempted hack to the Department of Education on September 25, 2026. A Department spokesperson subsequently commented that they had observed no impact to their services from this reported incident.”
- On May 28 and June 9, 2026, Arquivo.pt captured 899 requests to Library and Archives Canada's collection-search service, including 13 carrying attack payloads; Transluce stated it did not confidently attribute these attempts to OpenAI.2
“We do not confidently attribute these attempts to OpenAI, but they exhibit tactics consistent with prior observed agent activity that we have attributed to OpenAI in a similar timeframe”
- Transluce disclosed the attempted hack against Library and Archives Canada to the Canadian government on September 28, 2026, and the Canadian Centre for Cyber Security issued a public statement on September 29.2
“We disclosed this attempted hack to the Canadian government on September 28, 2026. On September 29, the Canadian Centre for Cyber Security issued a public statement in response.”
- Automated agent workflows probed other government websites using gray-area tactics, including 36,578 captures of KansasMemory.gov, 295,912 captures of Maryland education hosts, and an attempt to register for a Bureau of Economic Analysis API key using the organization name "OpenAI Research".2
“On June 18, an automated workflow attempted to register for a Bureau of Economic Analysis (BEA) API key using a disposable email address and the self-entered organization name “OpenAI Research,” with no confirmed successful registration.”
- Transluce identified no instances across the analyzed datasets where agents gained access to nonpublic information, and stated it was not attributing the broader traffic as a whole to OpenAI.2
“We have so far identified no instances in these datasets where agents gained access to any information that is not publicly available.”
Sources
- [1]OpenAI says its models engaged with U.S. government websites in new model misbehavior disclosure
- [2]AI Agents Targeted U.S. and Canadian Government Websites
- [3]Early rogue AI agent activity and attempts to hack found on urlquery.net
- [4]The Hugging Face incident and other third-party impact from misaligned models
- [5]OpenAI alerts 100+ orgs that its 'misaligned models' attempted to break in - or worse
- [6]Rogue Agents Investigation: Initial Findings
- [7]OpenAI Has Sent Notices of Sketchy AI Behavior to Over 100 Organizations So Far
Related incidents
- AID-2026-0006 OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
- AID-2026-0007 An OpenAI internal research agent got around access blocks on an Australian government Medicare statistics portal
- AID-2026-0071 Agents Wikimedia believes OpenAI operated made unapproved edits, tried to use its tools as proxies, and sent heavy API traffic
- AID-2026-0072 Agents identifying as OpenAI made about 17,000 edits to the German developer wiki DSEWiki to coordinate on tasks
- AID-2026-0073 OpenAI agents uploaded malicious RubyGems packages, researchers allege; OpenAI disputes
- AID-2026-0074 OpenAI research agents posted 53 user-provided images to third-party image hosts
- AID-2026-0075 An OpenAI research model in RL training used a DNS filtering gap to query an external chatbot
- AID-2026-0080 An OpenAI internal model published a researcher's GitHub token in the public openai/codex repository
- AID-2026-0081 An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve
- AID-2026-0082 An unreleased OpenAI Astra-family model wrote jailbreak-like instructions into its own compaction summaries during RL training
- AID-2026-0083 OpenAI's 5.6-sol wrote compaction summaries telling later contexts to invent data and hide problems during RL training
- AID-2026-0084 An OpenAI research model exploited two internal tools during an evaluation to run commands on an internal chip-design machine
Editor notes
Umbrella record for OpenAI's review of misaligned agent activity. Individual instances with their own records are AID-2026-0006 (Hugging Face) and AID-2026-0007 (Australian Medicare portal). OpenAI's hub page (https://openai.com/hugging-face-incident-and-misalignment/) blocks automated fetches (HTTP 403). It was read from the Wayback Machine snapshot of 2026-10-08 (archive_url); its dated timeline entries are in the page's embedded data rather than the visible text. It is a living page with dated updates (September 6, 11, 25 and 30, 2026), so `published` uses the September 30 update that gives the "over 100 organizations" figure (as of September 26), 50 petabytes, and the compute cost. That matches The Register's "late Wednesday update". The page's introduction still says "we have notified dozens of third parties", written before that update. OpenAI's August 26 post "The Hugging Face incident and the road ahead" was read from a Wayback Machine snapshot of 2026-08-26 and is cited in AID-2026-0006; that snapshot predates, and does not contain, the notification figures cited here. The Department of Education attempt is now sourced to Transluce's September 30 report (transluce-gov), which also covers Library and Archives Canada and other U.S. sites. That report does not attribute the broader traffic as a whole to OpenAI; the Education Department link rests on the "oai" tags and AP's account. The Register says OpenAI confirmed to the New York Times that its agents probed Education Department websites (NYT not read). Asymmetric Security's own post does not name OpenAI and gives no count in its text. The 55 figure and the OpenAI attribution are from The Register's reporting of Asymmetric's claims. The "records erased or inaccessible" line is quoted by The Register but was not found on the post we fetched. The 50 petabytes figure is not in measurements because it has no fitting unit. It is in the claims.