However, OpenAI has confirmed the incidents involving the Commerce Department and SEC and said it is still investigating the Education Department episode.
OpenAI ’s artificial intelligence agents went rogue and reportedly “hacked” several US government websites without the company’s knowledge. A report by The New York Times cited security researchers and a person familiar with the incident, who said the AI agents interacted with websites belonging to the US Education Department, Commerce Department, and Securities and Exchange Commission (SEC) in unusual ways this summer.
The company said none of the incidents involved breaches, but described them as examples of its AI technology behaving unexpectedly and concerningly. Researchers from AI research firm Transluce said an OpenAI agent attempted to hack the Education Department’s website while trying to gather information from its civil rights office. The incidents were discovered during an internal review of other hacking activity carried out by OpenAI’s AI agents, including attacks involving an Australian government health website and AI startup Hugging Face. The attempt failed.
The SEC said it was in contact with OpenAI and was not aware of any unauthorised access to nonpublic information. A Commerce Department spokeswoman said the information OpenAI accessed was publicly available on the Census Bureau website and did not include private data. The Education Department said its system reviews had found no evidence of an impact on its website or databases.
In another incident, an AI agent accessed publicly available information from the Census Bureau website, which is operated under the Commerce Department, using login credentials that it found online. Separately, OpenAI agents shared public information obtained from the SEC website on an online forum.