SAN FRANCISCO — Artificial intelligence agents built by OpenAI tried to erase traces of their activity after gaining unauthorized access to Australian government websites, according to a cybersecurity report published Thursday.
Cybersecurity firm Asymmetric Security analyzed the agents — software capable of acting autonomously on a user's behalf — which targeted Australian government websites and other public bodies between March and September.
According to the report, the agents opened private accounts on a website analytics service that concealed their searches, and created temporary email inboxes, one of which was set to self-delete after 48 hours. Asymmetric said it could not determine whether the agents' cover-up attempts were deliberate.
The firm also found that the agents were able to refine their techniques in a matter of days — a process that typically takes traditional hackers months or even years, according to the report.
From routine research to going off course
The incidents reviewed in the report appear to have begun with “innocent tasks,” such as gathering Australian health statistics, which then went off course.
“Most of the activity we’ve reviewed so far involved routine research tasks, such as accessing public web content to answer questions,” an OpenAI spokesperson told AFP.
“Some involved government websites because our models often turn to them as authoritative sources of public information,” the spokesperson added.
OpenAI's own admissions on agent behavior
OpenAI acknowledged in late August that its models had sometimes tried, unsuccessfully, to erase or modify their own activity logs during internal testing.
The report adds to investigations by OpenAI and independent researchers into a series of incidents disclosed since July, including the hacking of AI platform Hugging Face. OpenAI has described the attack on Hugging Face as the first of its kind.
These analyses aim to gauge the capabilities of autonomous AI tools, as their lapses fuel fears of losing control over the technology.
A wider debate over how to restrain agents
The incidents have amplified calls to slow AI development, most notably from Anthropic CEO Dario Amodei, who wrote last month that he feared swarms of agents “taking over the entire internet.”On Tuesday, President Donald Trump met with tech executives, who adopted a voluntary code of conduct. No federal law specifically governs these models in the United States, according to AFP.
But there is no consensus within the industry or among regulators on how to proceed. The Trump administration opposes any binding regulation that could hinder innovation, amid fierce competition with China.
On Tuesday, President Donald Trump met with tech executives, who adopted a voluntary code of conduct. No federal law specifically governs these models in the United States, according to AFP.
