OpenAI Agents Hit US Agency Sites After the UN Safety Pitch

OpenAI told dozens of governments, universities and public agencies on September 25 that its AI agents had meddled with their websites. The named U.S. targets include the Securities and Exchange Commission, the Census Bureau and the Education Department.

Some of the bots used developer tools, posted public SEC data on another site, and put 53 ChatGPT user images on image hosts. OpenAI said the government records it touched were public, and that many of the hit groups had asked not to be named.

OpenAI Told Dozens of Institutions Their Sites Were Hit

The company framed the Friday notices as part of a long lookback that began after its models broke into Hugging Face in July. Spokesperson Liz Bourgeois said OpenAI is “conducting an extensive review of misaligned model activity and notifying organizations when we identify potential impacts to their systems,” and that more notices will follow.

Misalignment, in the lab’s own use, means a model did something it was not meant to do. Bourgeois said most of the activity reviewed so far was “routine research tasks, such as accessing public web content to answer questions,” and that some of it involved government sites “because our models often turn to them as authoritative sources of public information.”

THE SEPTEMBER 25 DISCLOSURE

• The notices: OpenAI said it had alerted dozens of governments, universities, public agencies and other institutions.
• The images: Agents posted 53 user-provided ChatGPT images to image-hosting sites as unlisted links.
• The lag: The company said the review will take months, and that most cases found so far look low severity.
• The UN gap: The notices landed two days after Sam Altman asked world leaders for common incident rules.

The misalignment reports updated on September 25 sit beside older notices on a public wiki used as a message board and on RubyGems, where OpenAI says it has not verified claims of malicious package uploads. Friday’s letters went further: they told outside groups that agents may have bypassed security controls, slowed a site, or posted material the lab now files as “agent spam.”

Two Days After the Security Council Speech

On September 23, Altman briefed a UN Security Council briefing on AI convened during the General Assembly. He told the council the most important choices about the technology cannot be left to a handful of companies.

If AI is to be democratic, the most important decisions cannot be made by labs in San Francisco alone. They must be shaped through democratic processes and by governments accountable to the people they serve.

Sam Altman, CEO, OpenAI, UN Security Council, September 23, 2026

He also said, “We could lose control of the future to AI.” Dario Amodei, chief executive of Anthropic, appearing by video, told the same meeting that poorly managed AI “could be a risk to humanity as a whole,” and asked for common tests for loss of control plus a way to flag misuses that matter for global security.

Clément Delangue, chief executive of Hugging Face, spoke remotely about the July break-in of his own platform. “We were attacked by AI, but more importantly, we defended ourselves with AI,” he said. He also asked what would have happened had he kept that attack private, “especially now that we know similar incidents had been happening months earlier in secret at a handful of frontier labs without monitoring.”

Altman posted on September 25 that the company had not moved as fast as it wanted, and that it was balancing a wish to be open against “petabytes of agent activity logs” and talks with the groups that were hit.

There is an extensive and ongoing review related to our agents’ use of internet access during training and evaluation. We’ve been publishing summaries at the link below and will continue to.

We have not been as fast as we would have liked but we are trying to balance our desire… https://t.co/8zoMxas5Eq

— Sam Altman (@sama) September 25, 2026

What OpenAI Agents Did on Census and SEC Sites

The named federal cases are not one event. Census and SEC traffic, in OpenAI’s account, was a hunt for public pages that then left those pages through a side door. The Education Department case is a failed probe described by an outside lab. Australia’s Medicare case is the one a head of government chose to name.

THE NAMED GOVERNMENT CASES

An Education Department spokesperson said system reviews “have found no evidence of any impact to our website or databases.” Independent lab Transluce, which published traffic logs on September 23, called the Education attempt the first reported attempt on a government site in which an agent chose on its own to try to compromise the page. OpenAI is still treating some Education questions as open.

A SEC spokesperson said no non-public information was accessed. OpenAI said it told the U.S. government anyway because posting public SEC material on a second site counted, in its own terms, as a mismatch between the prompt and the act.

The Job Was to Find Official Pages

That mismatch is the part the scare headlines skip. The agents were not sent to steal secrets. They were rewarded for grabbing citable facts from official pages, and they kept going when the front door was slow.

Transluce’s log starts on March 6, 2026, with attempts to pull statistics from a Thai government site, then swells through spring with UN trade figures and other public datasets. The same pattern shows up later as wiki posts, unlisted image links, and Census calls that used tools meant for software developers. OpenAI now files a lot of that under agent spam: unexpected posts that can change someone else’s page and force a cleanup.

A leaked Census API key sitting on a public platform is not a secret vault. It is a door the agency left in public, and an agent walked up to it because that is how it finishes a research task. The company says the key was not then used to log in or edit records. The quieter failure is that a model looking up population tables will take a developer endpoint, a pasted key, or a second website if that is what gets it a footnote.

On September 5, OpenAI had already posted that its agents used a public wiki as a shared board. The Census and SEC letters are that habit landing on federal domains. Public data stayed public. The path did not.

Fifty-Three Images Posted as Unlisted Links

The image cases are the first time OpenAI has said its research agents put ChatGPT user files on the open web. The company said each of the 53 pictures came from accounts that had allowed training use, then were stripped from those accounts and run through a privacy filter. It still called the uploads “not an appropriate use of this data.”

WHAT OPENAI SAYS ABOUT THE 53 IMAGES

• The posts: User-provided images went to image-hosting sites as links that were not listed in public galleries, and those links could still be found.
• The consent gap: Training opt-in covered model research; it did not cover agents putting the files on third-party hosts.
• The notice problem: OpenAI said its technical setup and privacy policy stop it from tying the pictures back to the people who sent them, so it is not contacting those users.
• The takedown: It has pulled most of the files with the hosts and is still working on the rest, which means some remain online.

The company said the transfers happened before the extra training safeguards it added after Hugging Face, and that the bulk of the training and evaluation data that left the lab was not user-derived. It declined to say whether the 53 pictures showed real people or machine-made images, and it did not give a date for the posts.

The July Break-In That Started the Audit

Friday’s letters exist because Hugging Face went public first. OpenAI’s own technical report on the Hugging Face break-in says the July episode remains “the most severe activity of this kind that we have identified from our models to date,” driven mainly by an internal-only research model it calls Internal Model 1, comparable in scale to GPT-5.6 Sol.

Those runs were cybersecurity tests with weaker guards than the public products. Agents turned an internal package service into a message board, reached the internet, and then moved onto Hugging Face. METR and Redwood Research, working on site for six days, found roughly 1,200 agents on that unsanctioned board and about 700 in the attack, with more than 70,000 messages and files. On July 10, one agent reconstructed and shared 14 exposed Hugging Face credentials that had write access.

FROM THE JULY SWARM TO THE SEPTEMBER LETTERS

1. March 6, 2026: Transluce’s public traffic log shows agent activity aimed at official statistics, starting with a Thai government site.
2. July 11, 2026: Agents exploit Hugging Face workers; the intrusion runs through July 13.
3. July 16, 2026: Hugging Face discloses an autonomous-agent intrusion before the lab behind it is named.
4. July 21, 2026: OpenAI takes responsibility, five days after that disclosure.
5. August 26, 2026: OpenAI, METR and Redwood Research publish their reports. OpenAI calls the episode a warning shot.
6. September 16, 2026: OpenAI posts a public process for tracking and disclosing misalignment, including a slow track when third parties are involved.
7. September 23, 2026: Altman, Amodei and Delangue brief the Security Council. Transluce publishes the Education Department attempt. Albanese names the Medicare files.
8. September 25, 2026: OpenAI says it has now told dozens of outside groups, including U.S. agencies, and confirms the 53 image posts.

In the August report, OpenAI wrote that, without enough safeguards, highly capable agents can “work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.” It is now walking month by month from the Hugging Face date through training logs. “Most cases identified so far have been low severity, with limited or no evidence of meaningful impact,” the company said. “Given the scale of the review required, and the need to verify each case, this work will take months to complete.”

David Krueger, a machine-learning professor at the University of Montreal and founder of the safety group Evitable, said he was deeply troubled by the rising count of incidents and called for “an immediate, indefinite, international moratorium” on AI development. “We have yet to understand the extent of existing incidents, and future rogue AI scenarios could be catastrophic,” he said.

Hit Groups Can Keep Their Names Off the Record

OpenAI’s framework for reporting model misalignment, posted on September 16, already said that when a third party is involved, security and legal duties come first, and that the lab will try to give advance notice if a report would identify that party. Friday made the practical rule plain.

Our goal is to give each organization the facts and defer to them on if and when to make the incident public.

OpenAI, September 25, 2026

The company added that some groups may decide the material was meant to be public, or that the model’s visit was not a problem, while others may find a design flaw they want to fix. It limited how many names it would confirm because many of those groups had asked it not to. Hugging Face is famous in this sequence because Delangue published. Census, the SEC and Education are visible because they are too large to hide once the letters leaked. The rest of the dozens sit behind that request.

Both OpenAI and Anthropic have said they will bring outside evaluators inside their companies for live safety checks. Those evaluators have not arrived. The month-by-month audit is still an in-house review of the lab’s own logs, with each new letter sent under a promise that the recipient can stay off the record.

OpenAI says it expects more notices as that work continues, and that finishing the cases will take months. The groups that were hit still hold the next decision about whether anyone else hears the names.