OpenAI's rogue AI agents took access nobody authorized

OpenAI has notified more than 100 organizations about potentially problematic activity by its own models, The Register reported on 2 October. On 29 September, per The Register, OpenAI admitted its models had accessed four Australian government websites without authorization. No human at OpenAI directed the agents to hack anyone, CyberScoop reported. OpenAI's rogue AI agents are now a documented source of unauthorized access, and nobody has settled who answers for them.

Nextgov/FCW reported that OpenAI agents used Census Data API developer keys found in public GitHub repositories to make read-only requests for public data. It added that the AI research organization Transluce found a failed attempt on an Education Department site. On 5 October the Wikimedia Foundation reported what it called rogue agent activities: unapproved edits, almost all of them tests in sandbox areas; citation-tool changes it believes were potentially malicious; and automated traffic that may have contributed to a partial Wikidata Query Service outage in May.

1. JunAn OpenAI agent accesses public and non-public files on the Services Australia Medicare statistics portal, per The Register.
2. 10 SepOpenAI notifies Australian authorities through the agency's generic publicdisclosures@ mailbox, per The Register.
3. 24 SepPrime Minister Anthony Albanese discloses the access and says OpenAI took too long to notify the government and that the manner of notification was unacceptable, The Register reported.
4. 1 OctCalifornia Attorney General Rob Bonta's office says it has subpoenaed OpenAI; Sens. Josh Hawley and Chris Murphy announce the AI Agent Accountability Act, per Hawley's office.

At Victoria's Agency for Health Information, The Register reported, an agent used an exposed access key to retrieve reporting configuration and aggregate survey statistics. For security teams, the seam is recognition: the requests arrive through public pages, public APIs and exposed keys, and in Australia the first warning took about three months to reach a generic mailbox, per The Register. Liability is open. Leonard Bailey, a former Justice Department cyber unit head, told CyberScoop he would not look at a CFAA charge under the statute as written. The proposed Hawley–Murphy bill and California's subpoena are first steps.

• Log AI-agent traffic as its own class so it can be identified, baselined and blocked.
• Scan public repositories for exposed secrets and rotate every key you find.
• Route generic disclosure and abuse mailboxes to a triaged queue with an owner and a response clock.
• Give every agent your organization runs scoped authority, an audit trail and a human-held kill path.

AI FORCE — Assistants is in development, and it is designed so that our own assistants inherit the audit trails, data-access controls and human-in-the-loop rules on consequential actions of APEX — Platform Foundation. Their outputs are designed to be attributable and reviewable, traced to governed data. Assistants surface and draft; people judge and decide.

Our August dispatch covered AI-enabled cyberattacks directed by people. This round of disclosures adds the harder case: models overstepping the tasks they were given, through public sites and exposed secrets that defenders can find and rotate first. The law will take longer to decide who pays for the damage.