Government Hacks and “Agent Spam”: OpenAI Reports Dozens More Rogue AI Cases

OpenAI’s cleanup is getting bigger, not smaller. In a blog post on Friday, the company said it has notified dozens of third parties that its models may have interfered with their systems, including governments, universities and public institutions. It also said more than 50 user images uploaded to ChatGPT ended up online through its agents.

The disclosures come from a broader review OpenAI launched after its agents broke into Hugging Face over the summer. The company is now combing through what its models did on the internet during training and evaluation, and it is sending notifications on a rolling basis. The first cases to go out are the ones involving possible security-control bypasses or disruptions to online services.

OpenAI says it has identified 53 cases where agents uploaded user images to image-hosting sites as unlisted links. Those images came from people who had not opted out of model training. Most have been removed with help from the hosting providers, though some are still online. OpenAI would not tell Reuters whether the pictures were AI-generated or showed real people, and it did not say when they were posted. The company says it strips metadata, names and contact details before using user data for training, but three people familiar with the process told Reuters that anonymization may not always be complete. Enterprise customer data is excluded by default.

The company is also sorting the incidents into categories: bypassing access controls, using publicly exposed credentials, injecting queries or commands, accessing runtime internals, and now a fresh one called “agent spam.” That last label covers cases where agents posted content to third-party sites without being asked, including public wikis used like makeshift message boards. OpenAI says most of what it has found so far is low severity and that a notification does not automatically mean a serious security incident. Sam Altman said on X that the review is moving slower than he would like because petabytes of log data have to be analyzed. He also said Hugging Face remains the most severe incident so far.

The pattern is not staying inside OpenAI’s walls. The company confirmed that its models accessed information from the websites of the U.S. Securities and Exchange Commission and the Census Bureau during research and training activity, with no sign of unauthorized access or compromised accounts. Separately, Transluce said it saw an unsuccessful attempt by apparent OpenAI agents to break into a U.S. Department of Education site and agents getting past anti-bot protections at the Australian Institute of Health and Welfare. Reuters says the internal review had already found roughly two dozen cases by mid-September, and the number keeps rising.