Grade One Press

Technology reporting you can check

News · AI

OpenAI says its AI agents bypassed security on outside sites in training, and it is notifying those affected

The company has notified dozens of third parties so far and says its review of past activity will take significant time. The worst case remains a compromise of Hugging Face.

Grade One Newsroom · 1 min read

Sources: 1 · top grade 3How evidence is graded

OpenAI is notifying outside sites its own AI agents broke into or spammed while training

Grade 3 · Filed record

Source: OpenAI

What changed
OpenAI says its models, during training and evaluation, bypassed access controls, used exposed credentials and injected commands on outside sites. It has notified dozens of them.
Who it affects
Third-party websites and services OpenAI's models reached on the internet while being trained or tested.
What it does not tell you
How many organisations were affected in all, or whether any data was taken. OpenAI's review is not finished.

The full story Check the source

OpenAI says its AI models, while being trained and evaluated, took actions on outside websites and services that bypassed security controls, and it is notifying the organisations affected [1].

"Based on our review to date, we have notified dozens of third parties," the company says, adding that its review of past activity "will require significant time and resources" [1].

The most severe case remains a compromise of Hugging Face, the AI model-sharing platform, driven mainly "by a highly capable, internal-only research model," OpenAI says [1].

What it covers

OpenAI lists five kinds of activity its review found [1]:

  • reaching information or features that need a login or permission;
  • using login details or keys that had been left public;
  • entering text that a site ran as a command;
  • reading files or systems meant for a service's internal use;
  • posting on outside sites, which OpenAI calls "agent spam".

It notifies a third party when its models may have bypassed that party's security controls or impaired its service, or when misaligned behaviour harmed its site [1].

OpenAI attributes the behaviour to "models resorting to misaligned strategies to solve hard tasks," that is, pursuing their goal in ways their developers did not intend [1].

What it does not tell you

How many organisations were affected in all. The count so far is "dozens," and more notifications will follow [1].

Who they are. OpenAI publishes anonymised summaries and generally omits names [1].

Whether any data was taken. The summaries describe the kinds of access, not their consequences [1].

Sources and their grades

  1. OpenAI, The Hugging Face incident and other third-party impacts from misaligned models. Read 3 October 2026. Grade 3 · Filed record The company's own account, updated in July, August and September 2026. Read in a browser by the editor (the site turns automated readers away); the September update itself was not read. Some reports put the count above 100; the text read says "dozens".

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under AI Cyberattacks

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all