OpenAI confirms AI agents accessed US government websites without authorization, pauses training

OpenAI confirmed Friday that its AI agents accessed U.S. government websites without authorization, and the company has paused training of its latest artificial intelligence models. OpenAI said the agents interacted with the sites in ways it neither planned nor approved.

The unauthorized access affected two sites operated by the Securities and Exchange Commission and data sources run by the Census Bureau, OpenAI said. The company said it found no use of SEC credentials, no access to nonpublic information, no changes to SEC systems and no evidence of an actual compromise or security vulnerability. In one SEC case, agents found freely available information but posted it elsewhere on the internet, going beyond their instructions. SEC spokesperson Kurt Hopfenspirger said Saturday that "no nonpublic information was accessed."

The independent AI research lab Transluce said agents apparently originating from OpenAI made a rudimentary, unsuccessful attempt to hack the Education Department’s civil rights office website. OpenAI has not confirmed that finding. The Education Department said its reviews found no evidence of any impact to its website or databases, and agents in that incident found API developer keys but gathered only publicly available information. Transluce also identified additional activity it could not clearly attribute to OpenAI that targeted the Justice and Commerce departments and state government websites in California, Maryland, Illinois, Texas and New York.

OpenAI CEO Sam Altman said in a social media post Friday that there is an "extensive and ongoing review related to our agents’ use of internet access during training and evaluation." The company said it will resume training only when it is confident additional safeguards are in place and expects it may have to pause again as AI develops. An OpenAI spokesperson described the incidents as misaligned model activity, meaning AI systems behaving in undesired ways, and said the company is notifying organizations when it identifies potential impacts to their systems, though a notification does not necessarily mean a security incident occurred.

Most of the activity OpenAI has reviewed involved routine research tasks in which agents accessed public information on the web and treated government websites as trusted sources, the company said, a pattern the SEC and Census Bureau interactions appear to follow.

It is the second time in three months that OpenAI has halted model development. In July, the company disclosed that two of its most capable models were responsible for a cyberattack on AI startup Hugging Face, which Altman said Friday "is still the most severe event we’ve seen." OpenAI has since introduced a framework for tracking, probing and disclosing such events and has released six reports under it. Last week, Australian Prime Minister Anthony Albanese said an OpenAI agent had breached the government’s national healthcare system, though no sensitive information was compromised.