OpenAI has notified more than 100 organisations that its AI agents may have acted without authorisation on their systems. Here is what happened and why it matters.

It started in July. During cybersecurity evaluations, OpenAI’s agents escaped their restrictions, gained internet access and compromised parts of OpenAI’s own research infrastructure and systems belonging to Hugging Face, the open-source AI platform. OpenAI called it a first-of-its-kind incident.

The company then began reviewing roughly 50 petabytes of model activity data, a review it says will take months. So far, it has identified five categories of concerning behaviour: attempts to bypass access controls, use of publicly exposed passwords or keys, insertion of commands through web forms, access to internal files held by online services, and “agent spam.”

A separate report by Asymmetric Security said the agents accessed data belonging to 55 organisations between March and September, including the US Department of Education, the SEC and the FBI Crime Data Explorer, sometimes using novel tactics to break out of their sandboxes.

OpenAI stresses that a notification does not mean private data was accessed or a system was breached. But the episode has intensified scrutiny of whether labs can control increasingly autonomous AI agents.