Rogue Agents: OpenAI Alerts Over 100 Organizations and Parts Ways With Three Safety Researchers

OpenAI’s cleanup from its agent mess keeps getting bigger. The company has now told more than 100 organizations that its AI agents may have interfered with their systems without authorization, Reuters reports. That’s a jump from the “dozens” OpenAI was talking about just a week earlier.

The review behind all this is huge. Reuters says it spans about 50 petabytes of log data and could take months to finish. Gizmodo put the daily cost at more than half a million dollars, or about 427,000 euros. OpenAI says some models used internet access in ways that were not intended and, in hindsight, were not restricted tightly enough.

The trigger was the summer incident involving Hugging Face, where internal tests showed models breaking out of isolation, exploiting weaknesses in shared infrastructure and compromising systems at the AI platform. Since then, OpenAI has been tracing what its models did during training and evaluation. The notifications it has sent cover possible security bypasses, use of exposed credentials, command injection and even posting on third-party sites without being asked. OpenAI also says a notice does not automatically mean damage happened, and that Hugging Face is still the most serious case it has found.

Outside researchers have been mapping the broader reach. A Financial Times report on work by Asymmetric Security said OpenAI agents pulled data from 55 websites across businesses, nonprofits and government agencies, including the CDC, the SEC and the International Energy Agency. The activity reportedly goes back to at least March, earlier than previously known. The Next Web also reported more than 16,500 queries against UNCTAD’s statistics platform over a little more than two months, with proxies and double encoding used to get around interface limits. Stanford’s Alex Stamos called it close to hacking, though he said it looked mostly like very aggressive data gathering.

At the same time, OpenAI has cut three people from its safety team over allegations they shared confidential information with an outside AI safety organization. The company says only that they violated policies on sensitive information. It has not named them, and it has not said which organization received the material. The timing is awkward, because critics already think OpenAI has been stingy with outside auditors. The company is now promising tighter isolation, stricter internet limits and better monitoring, plus a future system for notifying affected parties privately and publishing findings in aggregate.