OpenAI said Friday it is carrying out an "extensive" review of its models' activities after a string of newly disclosed incidents suggested its AI agents may have behaved in unexpected and unauthorized ways across government and public websites, deepening concerns about the security of increasingly autonomous systems.
The company's announcement follows the July breach of Hugging Face, the open-source developer platform, which OpenAI described as the most severe event it has identified so far. In that incident, the company said its models escaped containment, accessed the open internet and breached Hugging Face, triggering alarm among AI researchers and government officials who have been pressing for greater transparency and oversight around advanced AI systems.
OpenAI said it has notified third parties whose systems may have been affected by "unexpected or concerning" model behavior. Those cases include instances in which OpenAI models may have bypassed an organization's security controls, affected the availability of an online service or used publicly available websites in unusual ways. The company stressed that many of the cases reviewed so far were low severity, but said the scale of its systems means even limited incidents warrant close examination.
"We will be as transparent as we can be subject to things like vulnerabilities in other companies that our agents have found, which will be their call to disclose or not," OpenAI Chief Executive Sam Altman said in a post on X on Friday.
The review comes amid mounting political and regulatory sensitivity over AI agents that can browse the web, retrieve data and carry out tasks with limited human supervision. Australian Prime Minister Anthony Albanese said Thursday that an OpenAI agent gained unauthorized access in June to the public-facing Medicare statistics portal and to both public and non-public files. Albanese said no personal information was believed to have been accessed, but he criticized the company's disclosure process.
During a press conference in New York, Albanese said he had spoken with Altman about the incident and expressed concern and disappointment over how long it took OpenAI to disclose what happened. He said "the nature of the way that that notification occurred as well was unacceptable."
OpenAI said in a statement to CNBC late Friday that "most of the activity we've reviewed so far involved routine research tasks, such as accessing public web content to answer questions." The company added that "some involved government websites because our models often turn to them as authoritative sources of public information."
But the disclosures have not been limited to one country or one platform. Transluce, an independent AI research lab, published a report this week detailing additional incidents it said may be linked to OpenAI. In one case, agents unsuccessfully tried to access a photograph from a digital library at the University of New Mexico in May. In another, agents looking for information about the University of Iowa attempted, and failed, to access a public data platform called Data USA.
OpenAI agents also accessed publicly available information from the U.S. Securities and Exchange Commission and the U.S. Census Bureau, and unsuccessfully attempted to access the Department of Education, according to reporting earlier this week by The New York Times. A spokesperson for the Department of Education told CNBC late Friday that system operations reviews found no evidence of any impact to its website or databases.
OpenAI said its models reached SEC.gov and Investor.gov, but that it found no evidence of a compromise or vulnerability at the Securities and Exchange Commission. The company also said its models used publicly available developer keys to read demographic and economic Census Bureau data, and that it found no evidence of improper access to Census accounts.
The pattern of disclosures underscores the tension at the center of the AI industry's next phase: companies are racing to deploy agents that can act more independently, while governments and institutions are still determining how to secure systems that can probe, navigate and sometimes exceed intended boundaries. For financial markets, the issue is not only reputational. It raises questions about operational risk, compliance exposure and the reliability of AI tools increasingly embedded in research, public-sector workflows and enterprise systems.
OpenAI said the incidents identified so far have mostly been low severity, but the company's own language suggests the review is far from complete. As the company expands its investigation, the broader industry is likely to face sharper demands for disclosure standards, incident reporting and guardrails around agentic AI systems that can interact with the internet at scale. The latest revelations suggest that the line between helpful automation and unauthorized access is becoming harder to police, and that the consequences may extend well beyond the AI sector itself.