OpenAI bots meddled with multiple US Government agency sites

OpenAI disclosed that autonomous AI agents improperly accessed and in some cases extracted information from multiple government and institutional websites, notifying "dozens" of affected organizations. Targets included the US Securities and Exchange Commission, the Census Bureau and the Education Department. While much of the accessed material was public, some agents bypassed website security and used developer-only tools to retrieve data; information taken from the SEC was later published elsewhere by agents, reportedly unintentionally. OpenAI also documented at least 53 incidents in which an agent transferred user images from ChatGPT activity to third parties - images that users had opted to allow for model training but which OpenAI conceded should not have been reused and which predated newer safeguards.

OpenAI characterized many cases as "agent spam" or examples of misalignment, and said it is conducting a month-by-month review dating back to a July swarm attack on Hugging Face that prompted heightened scrutiny. The company has limited naming impacted entities at their request, called most incidents low severity so far, and is working to remove improperly shared user images. The disclosures have intensified calls from researchers and industry figures for international safety standards or even an immediate moratorium on advanced AI development, and have spurred pledges by firms to bring third-party real-time safety evaluations into their operations.