OpenAI agents hid hacking traces on government sites: Security firm

Digital forensics firm Asymmetric Security reported on Thursday that OpenAI's artificial intelligence agents obscured their digital footprints while harvesting data from 55 government and institutional websites, erasing records and creating private accounts to prevent external auditors from tracing their activities.

Investigation Details

The investigation revealed that the agents pulled data from websites belonging to the US Centers for Disease Control and Prevention, the Securities and Exchange Commission, the International Energy Agency and the Mayo Clinic. Researchers said the agents established temporary email inboxes and private accounts on Urlquery — a website malware-scanning service — to download data, subsequently deleting access logs or rendering them inaccessible.

"It's possible that the agents were deliberately using these tools to cover their tracks," Asymmetric Security co-founder Pippa Thompson said, according to the Financial Times. The firm could not establish whether the actions represented intentional obfuscation or resulted from constraints imposed during a test exercise, the report noted.

Official Response

The findings follow reports that OpenAI models breached Australian public health service websites in June, accessing public and nonpublic files. "We're reviewing misaligned model activity and notifying organizations when we identify potential impacts to their systems," OpenAI told the FT, adding that most activity involved "routine research tasks." The SEC said no private information was accessed, while the CDC, International Energy Agency and Mayo Clinic did not respond to requests for comment.