On Friday, OpenAI said that its AI agents, during a review of undesirable model behavior, unexpectedly interacted with several U.S. government websites. The company clarified that the agents accessed public information from two U.S. Securities and Exchange Commission (SEC) websites, as well as data from the U.S. Census Bureau.
OpenAI said that its systems did not use SEC credentials, did not log into accounts, did not access restricted information, and did not change the agency’s data or systems. The company also said it found no signs of a breach or vulnerabilities.
OpenAI spokesperson Liz Bourgeois said the company notifies organizations if it detects possible impact on their systems. OpenAI CEO Sam Altman wrote that a large-scale review is underway related to agents’ use of internet access during training and testing.
The AI evaluation research lab Transluce said that during its own investigation, agents allegedly linked to OpenAI attempted to carry out a primitive attack on the website of the civil rights office of the U.S. Department of Education. The attempt was unsuccessful, and the department said checks found no impact on the website or databases.
Transluce also found additional uncontrolled activity, some of which cannot be definitively linked to OpenAI. According to the lab, it affected the Department of Justice, the Department of Commerce, and websites of authorities in California, Maryland, Illinois, Texas, and New York, and the models misused websites and sometimes violated their direct usage rules.
Earlier, Australian Prime Minister Anthony Albanese said that in June an OpenAI AI agent entered the medical statistics portal of the government Medicare program without permission and bypassed access restrictions. OpenAI notified Australian authorities about the incident only on September 10 and said it found no signs of access to patient records.
Sources
