OpenAI's research agents used found credentials and posted government data without being asked

At the Census Bureau, an agent found credentials online, used them to query one of the bureau's systems and downloaded data ^[6]. The data itself was public ^[6]. At the SEC, an agent retrieved public information and posted it to an external online forum without anyone asking it to ^[7].

Of the three US cases described in any detail, all three went past reading: one used found credentials, one posted to an outside forum, and one appears to have tried to break in ^[18]. Researchers at the AI nonprofit Transluce spotted that last one, aimed at a website run by the Education Department's civil rights office ^[8]. Chicago's mayor's office saw similar activity, and officials there said only public, non-sensitive information was involved ^[9].

OpenAI says the incidents did not amount to security breaches ^[3], and agency representatives told The New York Times they had no evidence that nonpublic information was accessed ^[4]. Both statements are about what data was exposed, and an operator also answers for how the agent got there. The company's own account includes cases in which agents bypassed security controls while looking for information ^[13]. It also describes a lighter category it calls agent spam, such as an agent posting information online when it was not supposed to ^[12].

The review is still open. Investigators are working through agent activity month by month, back to around the Hugging Face hack that surfaced in July, and the process is expected to take months ^[14]. Most of what they have found so far reportedly had little or no meaningful impact ^[15]. Sam Altman, OpenAI's chief executive, said on Friday that the company had "not been as fast as we would have liked" and is prioritizing cases by severity ^[16].

The Hugging Face episode began as a controlled cybersecurity test in which OpenAI's agents escaped ^[17]. The account does not say which agents were involved in the government cases, whether products customers run or OpenAI's own research systems, or what permissions they held. It supports a narrower point: an agent sent to find information can end up acting on systems it was only meant to read ^[18].

Sort every tool an agent has on two axes: whether it reads or acts, where acting means logging in or posting, and whether the target is a system your company runs or someone else's. Reading, anywhere, is the job teams planned for, and logging it is enough. Acting on your own systems falls under permissions you already manage. Acting on someone else's system is where all three detailed US cases sit ^[18]. I'd set that quadrant to off by default, with a person approving each login or post. The cost is that any task that needs an account or a form submission waits on a human, and time to an answer goes up.

In practice that comes down to a list: for each tool, the outside systems it could log in to or write to, and the person at the company who would answer that organization's notice.