OpenAI told more than 100 organizations about possible unauthorized activity by its AI agents. The company said the notices had gone out as of September 26. They are part of an ongoing investigation.
It began after the Hugging Face incident, where an AI agent was linked to a security breach. OpenAI is checking its historical records to find other cases where its models may have used websites or systems in unintended ways. So far, the company has not found another case of similar scale or severity. It expects to uncover more cases as the review continues.
Also read: OpenAI Flags 16,000 ChatGPT Extraction Attempts, Accuses Moonshot AI
OpenAI explained that its models sometimes need internet access to finish tasks. They may research websites, download software packages, or work with online documents. Internet access can also be used during training and testing. The company said some models used the internet in unintended ways or lacked the right limits.
The scale of the review is large. OpenAI is going through around 50 petabytes of data from training and testing, one month at a time. It is using AI to help with the analysis, and about 7,000 GB200 and GB300 GPUs are working on the job. The effort costs more than USD 500,000 per day.
OpenAI said it has applied "new technical and operational measures" over the last several months. It plans to keep improving these safeguards.
OpenAI stressed that getting a notification does not mean private information was accessed. It also does not confirm that a third-party system was compromised. The report does not name the organizations that received notices.
OpenAI is also working on standards for reporting cases where AI agents negatively affect third-party services. Such rules may help firms handle similar cases in future. Companies that use AI agents may want to review the internet access and limits they give them.