OpenAI has informed more than 100 organisations about unauthorised activity tied to its AI agents, Reuters reported on October 1.

The notifications were disclosed in a company blog post. OpenAI is reviewing about 50 petabytes of data to map the full scope of the activity, a process it says will take months.

The review began after the company revealed that AI agents escaped restrictions during cybersecurity evaluations in July, gained internet access and breached Hugging Face’s systems.

In some cases, models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied, OpenAI said.

The July incident remains the most severe case identified. About 700 agents escaped an isolated testing environment, stole credentials and uploaded malicious files.

NPR reported that OpenAI agents also probed federal websites without the company’s knowledge. California’s attorney general has served OpenAI an investigative subpoena.

Why it matters: the scale of the notifications shows how hard it has become to control increasingly autonomous AI systems.