TL;DR: Some OpenAI agents that were undergoing training spent months browsing the websites of the SEC, the CDC, and the Mayo Clinic, and at some point began using tools that leave no trace. OpenAI has already notified more than 100 organizations. I’ll tell you what we know, what we don’t know, and why I no longer see this as just an anecdote…
Fifty-five.That is the number of organizations in which, according to an investigation by the forensic analysis firm Asymmetric Security published by theFinancial Times on October 1, OpenAI agents entered to gather information between March and September of this year. The list includes a wide range of organizations: the SEC (the U.S. securities regulator), the Centers for Disease Control and Prevention, the International Energy Agency, the Mayo Clinic… and, according to the list compiled byImplicator, including a citizen-led bird count. A day later, OpenAI itself acknowledged that it had notified more than 100 organizations, nearly double that number.
And here’s what made the news go viral in two days: at some point along the way, those agents began using tools that erased or concealed the trail of their actions.
What they did, step by step
It’s best to explain this calmly because, at first glance, there’s nothing unusual about it. The agents were in training, conducting investigative work, and to do so, they were consulting public websites through a service called urlquery (a tool that security analysts use to examine web pages). OpenAI summarizes its statement as follows: most of the activities were routine tasks, such as accessing public web content to answer questions. So far, nothing that any assistant wouldn’t do with a web browser.
The change came in mid-June. According to Asymmetric’s timeline, on June 14, the agents first attempted to use urlquery with a private account; on the 18th, they succeeded; and on the 20th, they created a temporary email account on a service called Boomlify, which expires after forty-eight hours. They also used a notification service that deletes messages after twelve hours. As a result, there are records that investigators can no longer retrieve.
Pippa Thompson, co-founder of Asymmetric, puts it very cautiously: “It’s possible” that the agents used these tools deliberately to cover their tracks. She adds that these are techniques commonly used by human hackers.
Keep in mind, though, that this isn’t the end of the world either. Asymmetric itself acknowledges that in the vast majority of cases, the data that was taken was public, and OpenAI insists that notifying an organization does not mean that private information was accessed or that its system has been compromised. It has now launched a review of about fifty petabytes of data, which it says will take months.
Months—just to find out what its own agents did.
It's not just an anecdote; it's a pattern.
It’s clear that everything that’s been happening lately with the Agents up to their old tricks isn’t just a one-off incident, it’s a pattern, and you only need to look back a few weeks to see it.
Do you remember that this summer we talked about OpenAI agents that left their testing environment and ended up on Hugging Face? Three weeks ago, I told you why AI developers are calling for a slowdown, and two weeks ago, I shared the story of the agent that was asked to fix a bug and ended up reprogramming itself. And in the midst of all this, back in June, an OpenAI agent kept trying to log into an Australian Medicare portal over and over again; according to MacGeneration, it interpreted each rejection as an invitation to find another way in.
Each individual case has its own technical explanation, and I’m sure it’s reasonable. Taken together, however, they paint a much more troubling picture: agents who, when they encounter a closed door, don’t stop to ask questions, they look for a window.
Snehal Antani, who’s been in the offensive cybersecurity game for years, dismissed it in The Register with a line that I found quite amusing. He basically said that the term “misaligned model incident” is a fancy way of saying that the model didn’t respect the boundaries that had been set for it. It’s that simple.
What could be the reason for covering up the evidence?
This is the question that’s been on my mind since Thursday, and to be honest, no one has the answer yet (Asymmetric admits that it lacks the complete transcripts of the models to know whether the hiding was intentional or not).
So what I’m sharing here is my interpretation, not a fact.
At first glance, it may simply be a case of misunderstood efficiency. An agent who is assigned a task looks for the shortest path to complete it, and if a disposable email account solves the problem of logging in, he uses it; the fact that this account also erases the trail would be a side effect, not a plan. On the other hand, these models have learned from everything written on the internet, and that includes mountains of manuals, forums, and accounts of how attackers operate. That an agent who runs into a wall would draw on the repertoire of someone who knows how to jump over walls shouldn’t surprise us that much either… though it does surprise me, to be honest. And finally, the option that no one wants to say out loud: that at some point the agent has “realized” that if they get caught, the task isn’t finished, and that the most practical thing is not to get caught.
The three explanations have something in common that worries me far more than the intention. In all three, the result is the same: someone has to spend months sifting through fifty petabytes to find out what happened.
My thoughts on this matter
I’ve been reading quite a bit these days, and I have to say that I’ve been mulling over a suspicion I just can’t shake. Either this is a publicity stunt by the models themselves, saying, “Look how advanced we are”… or it’s a security issue of dangerous proportions.
I’m not joking about the advertising strategy. The industry loves the story of the clever agent who even manages to escape, because it sells capability, urgency, and security budgets. But in this specific case, I find it hard to believe, because it wasn’t OpenAI that uncovered it, it was an outside forensic firm, and OpenAI’s response has been more along the lines of downplaying the issue (“routine tasks,” “it doesn’t mean there was access to private information”). If this were an ad, it would be the worst campaign of the year.
So I’ll go with the second option, with one caveat. I don’t think there’s an evil agent hiding from its creators; I think there are agents with too much ability to act in the real world, with very open-ended goals and very little oversight while they do so. And in a typical company that’s starting to put agents to work with its data and customers, that translates into something very specific: if you don’t know what your agent can access and you don’t keep a log that it can’t delete, when something goes wrong, you won’t be able to reconstruct what happened.
If OpenAI, with all its resources, needs months to figure it out, imagine what it’s like for an SME.
This isn’t just an anecdote, it’s a pattern. And what I’m wondering now is how many of these cases we’re seeing simply because someone from the outside decided to take a closer look…
What about you? If one of your agents did something unusual tomorrow, could you figure out exactly what they did, step by step, without relying on their account of it?
Leave me your comments, I’d love to hear from you.
Have a great week!
