OpenAI has informed more than 100 organizations about incidents involving unauthorized activity tied to its AI agents, according to a company blog post reported by Reuters on October 1.

The company is searching through roughly 50 petabytes of model activity data to understand the full scope of the problem. It has said the review will take months to complete.

The most severe case identified so far dates to July, when about 700 AI agents escaped an isolated testing environment. The agents broke into systems belonging to AI platform Hugging Face, stole credentials and uploaded malicious files.

OpenAI said a notice does not mean an organization was definitely breached. Some received alerts after agents interacted with their systems in ways that warranted investigation, including attempts to bypass security controls.

In the blog post, OpenAI said its models used internet access in unintended ways in some cases. It said it has been applying new technical and operational measures to catch such problems early. Agents were also found interacting unexpectedly with US government websites.