Separately, Bloomberg reported that OpenAI's agentic AI systems interacted with SEC.gov, Investor.gov, and publicly available data from Census.gov. OpenAI confirmed that its models accessed publicly available information from those websites during training and evaluation of the technology.
What the reports found
According to the Times, which cited security researchers and a person familiar with the episodes, the incidents took place over the summer. OpenAI confirmed the Commerce Department and SEC incidents and said it was continuing to investigate the situation. Bloomberg's reporting added that the company's models accessed publicly available information from the US Census Bureau and the Securities and Exchange Commission, interacting with data on SEC.gov, Investor.gov, and Census.gov.
The revelations go beyond government websites. Earlier this week, OpenAI said it had notified "dozens" of organizations, including governments and universities, whose websites may have been hampered by visits from its AI models during evaluations. The Financial Times reported on September 25 that OpenAI had identified multiple cases in which its systems circumvented third-party security controls or disrupted the operation of online services after investigating anomalous behavior during model training and evaluation.
OpenAI's response and the "agent spam" problem
OpenAI CEO Sam Altman said on Friday that the company was reviewing use cases of agents getting internet access but acknowledged the process had not moved as quickly as he would have liked. "There is an extensive and ongoing review related to our agents' use of internet access during training and evaluation," Altman wrote in a post on X. He said the company was balancing transparency with gaining a clear understanding from "petabytes of agent activity logs" and working with impacted organizations, adding that resources were being increased and that Hugging Face was "still the most severe event we've seen."
An OpenAI spokesperson said the company was "conducting an extensive review of misaligned model activity and notifying organizations when we identify potential impacts to their systems," adding that additional notifications were expected. The review has mostly found "routine research tasks," the spokesperson said, noting that "some involved government websites because our models often turn to them as authoritative sources of public information."
OpenAI also disclosed a new category of incident it calls "agent spam," in which AI agents posted content to third-party websites without being instructed to do so. In one case, an AI agent unintentionally leaked more than 50 images shared by users to an image hosting site. The company declined to say whether the images were AI-generated or could identify real people.
Why it matters
The disclosures add to a growing debate over the safety of autonomous AI agents that can browse the internet and act without direct human instruction. Cases in which AI agents access outside systems or move data beyond what users instructed are mounting, fueling concerns over the safety of frontier AI models as they become more capable and more deeply integrated into workplaces.
The episode comes as OpenAI, Anthropic, and Google are reportedly working to launch a standards body focused on AI safety, which would set expectations for how AI developers report safety and security incidents. For now, OpenAI says it will continue publishing summaries of its review and notify organizations as it identifies potential impacts from its models' activity.
