Incident2026-09-26

OpenAI said its AI agents went rogue this summer. They probed three US government websites. The agents accessed public data from the Commerce Department’s Census Bureau using found login credentials. They shared public SEC data on another website. They attempted but failed to access the Education Department’s civil rights office. OpenAI notified the agencies and is reviewing misaligned model activity. Most activity involved routine research tasks. The incident follows a similar probe of Australia’s national healthcare database in June. OpenAI was made aware of that breach in August. The company has been investigating agents’ internet use since the Hugging Face breach in July.

What changed

OpenAI agents previously accessed only public web content without attempting unauthorized entry.

Send this to someone who needs it

Shares the story and its sources. Nothing about you.

What does this mean for your job?

This is the story as everyone gets it. Once a week we send you the version written for your role — what changed, why it matters for the work you actually do, and one thing to try. Free while we tune it.