OpenAI's systems carried out unexpected activity on US govt websites: Report

OpenAI’s artificial intelligence agents interacted with several US government websites in unexpected ways this summer, including attempting to access the Education Department’s civil rights website, retrieving publicly available data from the Commerce Department and sharing Securities and Exchange Commission data online.

OpenAI CEO Sam Altman said the company had not disclosed some incidents as quickly as it would have liked. (REUTERS)The incidents, involving the Education Department, Commerce Department and SEC, were reported by The New York Times, citing security researchers and a person familiar with the episodes.

OpenAI confirmed the Commerce Department and SEC incidents and said it was continuing to investigate what happened at the Education Department.

Researchers at AI security firm Transluce said an OpenAI agent attempted to hack the Education Department’s website to collect information from its civil rights office, but failed, the NYT reported.

Another agent used login credentials found online to access publicly available information from the Census Bureau, which is part of the Commerce Department. Separately, OpenAI agents shared public information from the SEC website on an online forum.

OpenAI said none of the incidents amounted to a breach. The company said the interactions were examples of its AI systems behaving in unexpected ways and that it had notified the agencies in recent weeks.

The incidents were uncovered during an OpenAI review of hack. That review also examined an attack on an Australian government website in June and an incident involving AI startup Hugging Face in July.

The latest disclosures add to a broader series of incidents involving AI agents developed by OpenAI, Anthropic, Meta and Google.

In several cases, the systems have attempted to breach companies, universities or government organisations, with some attempts succeeding and others failing.

OpenAI has faced multiple such disclosures. Its investigation into the Hugging Face incident also identified a breach of an Australian government public health website, along with at least six other attempted breaches and cases where AI systems allegedly hid mistakes, generated false data or moved files onto the open internet without permission.

An OpenAI spokeswoman said the company’s review was “extensive” and “ongoing”.

“Most of the activity we’ve reviewed so far involved routine research tasks, such as accessing public web content to answer questions,” she said. “Some involved government websites because our models often turn to them as authoritative sources of public information.”

OpenAI CEO Sam Altman said the company had not disclosed some incidents as quickly as it would have liked. He said the company was prioritising incidents based on their severity and described the Hugging Face breach as the most serious event it had discovered.

The SEC said it was in contact with OpenAI and was not aware of any unauthorised access to nonpublic information. The Commerce Department said the information accessed from the Census Bureau website was publicly available and did not include private data.

The Education Department said system reviews had found no evidence of an impact on its website or databases.

Separately, Chicago officials said OpenAI had informed the city that its technology obtained publicly available information from a municipal website and that there was no indication that sensitive information had been accessed.

Conrad Stosz, head of governance at Transluce, said OpenAI’s agents had used “an array of gray-area tactics” when interacting with government websites, including using sites in unintended ways and sometimes violating explicit usage policies.

Transluce also identified other activity that could not clearly be linked to OpenAI. Stosz said AI agents had probed several federal and state government websites, including those belonging to the Navy and the White House’s Office of Management and Budget.

Follow the latest breaking news, major developments and agenda-setting stories from India and around the world with the newsdesk at Hindustan Times. Operating round the clock, the desk brings together experienced editors, reporters and correspondents to deliver fast, accurate and contextual reporting across subjects that influence public policy, governance, business, society and international affairs. The HT News Desk covers politics, elections, government policies, the economy, business and markets, science and technology, the environment, law and order, infrastructure, education, climate issues and geopolitics, while closely tracking developments across states, institutions and global capitals. The team also leads coverage of major breaking news events, policy announcements, court proceedings, natural disasters, public emergencies and significant international developments. Reports published by the newsdesk are based on information gathered from reporters on the ground, official statements, government agencies, court records, regulatory filings, recognised institutions and other authoritative sources. Stories undergo editorial scrutiny and verification processes to ensure accuracy, fairness and relevance, and are updated as events evolve and additional information becomes available. Whether covering a key political decision in New Delhi, an economic policy shift affecting millions, a landmark court ruling or a major global event, the HT News Desk aims to provide readers with reliable, fact-based journalism that delivers not only the latest developments but also the context and analysis needed to understand their wider implications.Read More