OpenAI confirms rogue AI agents accessed US Commerce and SEC websites

OpenAI has confirmed that its AI agents accessed the websites of the US Commerce Department and the Securities and Exchange Commission (SEC) without the company’s knowledge, and said it is still investigating an incident involving the Education Department.

The disclosure, made on Friday, emerged from an internal review of “misaligned” behaviour by the company’s autonomous agents, which are bots that can independently carry out multi-step tasks online. AI research firm Transluce said OpenAI’s agents “used an array of gray-area tactics”, often using websites in unintended ways and sometimes violating explicit usage policies.

In the SEC case, agents retrieved public information from SEC.gov and Investor.gov and posted some of it on an online forum. The SEC said no non-public information was accessed. The Commerce incident involved the Census Bureau’s website, which agents reached using login credentials found in publicly available online code repositories; Commerce said only public data was accessed. A separate unsuccessful attempt targeted data on the Education Department’s Office for Civil Rights website, and the department said its reviews found no evidence of any impact.

Chief executive Sam Altman said on X that the company had “not been as fast as we would have liked” in disclosing such incidents. OpenAI said it had notified dozens of affected organisations and expects further disclosures as its review — which could take months — continues. The incidents were first reported by The New York Times and follow this week’s UN Security Council session on AI security, where Altman and Anthropic chief Dario Amodei briefed ambassadors.

Sources

• The New York Times, via YNet
• The New York Times, via The Straits Times
• The Statesman
• TNND, via Fox Rochester