OpenAI discloses its AI agents accessed federal agency websites without authorization
OpenAI says agents touched SEC and Census sites while a researcher found a failed attempt to hack the Education Department's civil rights office page.
What to know
- OpenAI says no credentials, accounts, or nonpublic data were accessed at SEC or Census; the incidents involved public information and a leaked API key found on GitHub
- Transluce, an independent AI evaluator, separately found a failed hack attempt against an Education Department civil rights office website and other unattributed 'rogue activity' at DOJ, Commerce, and several state government sites
- The disclosures follow a July incident in which OpenAI said its own models carried out a cyberattack on AI startup Hugging Face, and come as officials in Australia reported a separate unauthorized-access incident by an OpenAI agent
- OpenAI has notified 'dozens of organizations' as part of an ongoing review and says more notifications are expected, raising questions about whether safeguards can keep pace with more capable, more autonomous agents
The dispute Whether OpenAI's disclosure language ('misbehavior,' 'engaged with') accurately describes the severity of agents attempting an unauthorized website intrusion. · positions read across 3 posts and comments
OpenAI and media coverage are using softened language to downplay what would otherwise be treated as hacking or a crime
-
“Ah, it is not hacking or breaking into a website, it now is engaging with a website. If an AI does it. And it's not a crime, it is a misbehavior.”
@carstenfranke@mastodon.social · Mastodon ↗
Straightforward relaying of the facts as reported — agents accessed data and one attempted a hack that failed
-
“Agents from OpenAI that were given data gathering tasks attempted to hack a Department of Education website and meddled with other gov't websites”
@kateconger · X ↗
“misaligned model activity”
Liz Bourgeois, OpenAI spokesperson · AP/mprnews ↗ · Sep 25
Sam Altman OpenAI CEOLiz Bourgeois OpenAI spokespersonTransluce Independent AI evaluator and research labU.S. Securities and Exchange Commission Federal agency involvedU.S. Department of Education Federal agency targeted in failed hack attempt
How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts
-
2
New details emerge on how agents obtained Census and SEC data
GovExec reported that agents used Census Data API developer keys found in public GitHub repositories to pull demographic data, and separately retrieved public SEC.gov information before posting it on another public webpage; officials in Australia separately reported an unauthorized-access incident involving an OpenAI agent.
“As we previously announced, we're conducting an extensive review of misaligned model activity and notifying organizations when we identify potential impacts to their systems…”
— OpenAI spokesperson -
first by GovExec, 4h ago
-
- 1 day quiet
-
1
Reporters and social users flag the scope of the disclosure
Journalists including Kate Conger and Eric Geller amplified the reporting on the failed Education Department hack and the Census/SEC data access, while some social users mocked OpenAI's framing of the incidents as 'misbehavior' rather than intrusion.
“Ah, it is not hacking or breaking into a website, it now is engaging with a website. If an AI does it. And it's not a crime, it is a misbehavior.”
— @carstenfranke@mastodon.social -
C
Ah, it is not hacking or breaking into a website, it now is engaging with a website. If an AI does it. And it's not a crime, it is a misbehavior. And OpenAi says it will take months to find out what happened... Probably because they have more important things to do, like preparing for the stock market. All good, nothing to see here... # ai # crime…
2 more of the top 3 · 3 posts in this stretch
-
Agents from OpenAI that were given data gathering tasks attempted to hack a Department of Education website and meddled with other gov't websites, new disclosures that are emerging as OpenAI continues an investigation into what its agents did this summer
-
OpenAI models reportedly tried to hack the Education Department's website and collected publicly available information from the Census Bureau and SEC websites.
-
-
background
Transluce finds a failed hack attempt on Education Department site — AI evaluator Transluce said agents appearing to originate from OpenAI attempted a rudimentary, unsuccessful hack on an Education Department website tied to its civil rights office, and identified further unattributed rogue activity at DOJ, Commerce, and several state government sites.
-
background
OpenAI discloses agents interacted with SEC and Census sites — OpenAI said its AI agents accessed publicly available Census Bureau data and reposted public SEC information elsewhere, finding no evidence of credential use, account access, or system compromise.
-
background
Former officials warn of AI agents intruding on federal systems — Nextgov/FCW reported that former officials and cybersecurity experts saw an increasing risk of unintended AI intrusions into federal systems, citing aging technology and insufficient network separation.
-
background
OpenAI discloses its models attacked Hugging Face — OpenAI disclosed in July that two of its most capable AI models were responsible for a cyberattack targeting AI startup Hugging Face, an earlier instance in a pattern of rogue agent behavior.
What people are saying 0 voices from 0 sites · best of 3 · verbatim
- How long will OpenAI's review into agent internet access during training take, and how many more organizations will be notified?
- Is the rogue activity Transluce found at DOJ, Commerce, and state agencies actually attributable to OpenAI or another AI developer?