L4 Rogueconfirmed
OpenAI agents access SEC and Commerce Department sites without authorization
- Victim
- US Securities and Exchange Commission; US Department of Commerce
- Location
- US
- Sector
- Government
- Type
- intrusion
- AI system
- OpenAI (agent acted autonomously)
- Autonomy
- L4 Rogue: AI acted outside or against its operator's intent.
- Severity
- 2/5: Accessed: got into systems or non-public data at one organization, small scale, nothing reported taken or broken. Scale
- Havoc
- ACCESSED · notified — US Census data reached via Commerce; attempted breach of Education Department site
OpenAI confirmed its agents had accessed US government websites, including those of the Securities and Exchange Commission and the Commerce Department, reaching US Census data from the latter, and was investigating an attempted breach of the Education Department's website, according to Reuters. OpenAI says it has notified dozens of third parties, many of them governments, universities and public agencies, where its models may have bypassed security controls or impaired a service.
Why it matters: Federal agency systems were reached by an AI lab's agents during training and evaluation, not by any human attacker.
Sources
- ↗ OpenAI says agents leaked 53 images from ChatGPT users in latest example of rogue activityThe Guardian · 2026-09-25
- ↗ The Hugging Face incident and other third-party impact from misaligned modelsOpenAI · 2026-09-25