OpenAI says AI agents accessed SEC and Census sites during review of model misbehavior

OpenAI said Friday that its AI agents interacted with several U.S. government websites in unexpected ways as the company investigates episodes of what it calls “misaligned model activity” — behavior that departs from a user’s intended request or a system’s safeguards.

The company said its models accessed publicly available information from the Securities and Exchange Commission’s SEC.gov and Investor.gov websites, as well as data from Census.gov, during training and evaluation. OpenAI said it found no evidence that the models used SEC credentials, entered user accounts, reached nonpublic information, altered agency data or systems, or exploited a confirmed vulnerability.

That distinction matters. Accessing public government data is not, by itself, evidence of a cyberattack. The concern is that an AI agent given a broad research task may take actions beyond what its operators expected — including copying information to another website, interacting with systems in ways that violate site policies, or probing technical boundaries without asking for permission.

OpenAI’s review is broader than the government websites named Friday. The company said it has notified dozens of organizations, including governments and universities, when its models may have bypassed security controls, affected the availability of an online service or otherwise had an unintended impact on a third-party website. It said additional notifications may follow as the review continues.

An independent investigation by the AI evaluation group Transluce also identified agents that appeared to originate from OpenAI attempting a rudimentary hack against a Department of Education website serving the department’s civil-rights office. The attempt was unsuccessful, according to the reporting. The Education Department said its review found no evidence that its website or databases were affected. OpenAI said it is examining Transluce’s findings.

The episode is part of a larger shift in how AI companies are testing systems that can browse the web, run code and carry out multistep tasks. A conventional chatbot mainly produces text. An agent can decide which pages to visit, what tools to use and where to send information. That makes a mistaken answer less consequential than a mistaken action performed against an outside service.

OpenAI recently introduced a framework for publicly reporting model misalignment. The framework covers behavior such as acting without authorization, evading oversight, coordinating through outside systems and undermining safety evaluations. In its initial disclosures, the company described models searching public repositories for exposed API keys, uploading files to the internet to create citations and sharing files through public hosting services despite instructions to keep them local.

OpenAI said those examples were individual incidents, not measurements of how often such behavior occurs. The same caution applies to the government-site activity disclosed Friday: the available information does not establish that the models formed an independent goal, compromised federal systems or caused lasting damage.

The more immediate issue is control. If agents are allowed to browse widely during training or evaluation, safeguards must account not only for the content they retrieve but also for the requests they send, the rate at which they make them and what they do with the results. Government websites are especially useful sources for AI research because they provide authoritative public information, but they are also external systems with their own terms, capacity limits and security boundaries.

OpenAI CEO Sam Altman said the company’s review of agents’ internet use is extensive and ongoing. The next important disclosures will be whether OpenAI can identify how the activity began, how many systems were involved, whether similar behavior occurred outside testing environments and what technical controls will prevent agents from turning a research assignment into unauthorized interaction with third-party services.