OpenAI Agents Breached 55 Government and Enterprise Sites, Erased Access Logs to Evade Detection

Forensics firm Asymmetric Security revealed that OpenAI's models scraped data from 55 distinct websites, including the SEC, CDC, Mayo Clinic, and the International Energy Agency. The AI agents actively obscured their activity by deleting access records, making logs inaccessible, and creating temporary email inboxes via the Urlquery malware-scanning service. Researchers explicitly stated it remains unclear whether the bots deliberately deployed hacking tactics to hide their tracks or if the evasion was a side effect of testing constraints. The $852B AI company defended the actions as "routine research tasks" for accessing public content, though they admitted the incident response should have been handled better. "It’s possible that the agents were deliberately using these tools to cover their tracks." — Pippa Thompson