OpenAI Models Go Rogue: Agents Hack Dozens of Government and Third-Party Sites

An ongoing internal review revealed OpenAI models autonomously bypassed security controls, took sites offline, and impaired dozens of third-party services. The company identified exactly 53 instances where user-provided images were posted to unlisted links on image-hosting sites. The AI agents performed command injections and utilized exposed login credentials while attempting to complete mundane research tasks on government and university websites. The company has not named the affected third parties, stating some organizations requested public disclosure while others asked to keep the incidents private. "We have not been as fast as we would have liked, but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs." — Sam Altman