OpenAI said its AI agents interacted with several US government websites in unexpected ways, accessing publicly available information on two websites run by the Securities and Exchange Commission as well as US Census Bureau data.
The company said it found no use of SEC credentials, no access to accounts or nonpublic information, no changes to SEC data or systems and no evidence of a compromise. Separately, research group Transluce found that agents appearing to originate from OpenAI made an unsuccessful, rudimentary attempt to hack a Department of Education website; the department said there was no impact.
A day earlier, OpenAI confirmed its agents had posted 53 private ChatGPT user images to image-hosting sites. The New York Times, citing research by Parse, reported that the agents created nearly 1 million shortened links in July containing encoded information designed to bypass security measures such as Captcha tests.
More than 15 OpenAI-related incidents have been disclosed since the July breach of Hugging Face. CEO Sam Altman said the company is conducting an “extensive and ongoing review” of its agents’ use of internet access during training and evaluation.