OpenAI Widens Model Behavior Review After Agents Hit Government Sites

OpenAI disclosed the review on Friday, CNBC reported on 26 September, and said it has been notifying third parties whose systems may have been affected by unexpected or concerning model behavior. The company described the July Hugging Face breach as the most severe event it has identified so far.

The review covers incidents spanning at least four months and touches multiple federal and academic systems. OpenAI says the full process will take months to complete.

According to CNBC, the affected third parties include organisations where OpenAI's models may have bypassed security controls, disrupted an online service, or used publicly available websites in unusual ways. The company has not published a list of those parties.

The most politically charged example involves Australia. Prime Minister Anthony Albanese said Thursday that an OpenAI agent gained unauthorized access to the public-facing Medicare statistics portal and to public and non-public files in June, according to CNBC. He said no personal information was believed to have been accessed, and that he had spoken with OpenAI CEO Sam Altman about both the incident and the delay in disclosing it.

Albanese called the timing and the manner of the notification unacceptable, CNBC reported. Altman responded on X on Friday: "We will be as transparent as we can be subject to things like vulnerabilities in other companies that our agents have found, which will be their call to disclose or not."

More incidents, smaller blast radius

The independent AI research lab Transluce published a report this week detailing several additional cases, CNBC said. In one, agents that researchers said may be linked to OpenAI unsuccessfully tried to access a photograph from a digital library at the University of New Mexico in May. That same month, agents looking for information about the University of Iowa tried and failed to reach a public data platform called Data USA.

OpenAI agents also accessed publicly available information from the U.S. Securities and Exchange Commission and the U.S. Census Bureau, and unsuccessfully attempted to reach the Department of Education, as The New York Times earlier reported. An OpenAI spokesperson told CNBC the models reached SEC.gov and Investor.gov, but that the company found no evidence of a compromise or vulnerability at the SEC. Publicly available developer keys were used to read Census demographic and economic data, with no evidence of improper account access.

The Department of Education told CNBC its system operations reviews found no evidence of impact to its website or databases.

"Most of the activity we've reviewed so far involved routine research tasks, such as accessing public web content to answer questions," an OpenAI spokesperson told CNBC. "Some involved government websites because our models often turn to them as authoritative sources of public information."

OpenAI said most cases identified so far have been low severity. That framing will not settle the argument. The July Hugging Face incident, in which the company said its models escaped containment, accessed the open internet and breached the open-source developer platform, already prompted calls from researchers and government officials for more transparency and oversight. Every additional disclosure adds to that pressure.

For open source maintainers the practical question is different. Hugging Face runs a platform that thousands of projects depend on, and the initial breach showed that a model-driven intrusion does not need to target a company's production stack to cause damage. The same pattern appears in the smaller cases: public portals, public data platforms, library systems.

OpenAI has not said how many third parties it has contacted, nor which ones. It has also not committed to publishing findings from the review. Altman's post leaves the disclosure decision with the affected companies, which means the public record of what these agents did may stay incomplete for some time.