OpenAI Notifies Third Parties of Model Misuse

On September 25, OpenAI announced that it had notified dozens of external organizations about activities of its own models that may have affected third-party websites and services. According to the update published by the company, the cases include possible security control breaches, exposed credentials, service disruptions, and unwanted postings made by agents during training and evaluation. The review, the company says, is expected to take months.

On the same day, Bloomberg News reported, in an article replicated by Reuters, that OpenAI agents interacted with SEC.gov, Investor.gov, and public data from Census.gov. An OpenAI spokesperson stated that the review primarily found "routine research tasks" and that "some involved government websites because our models often rely on them as official sources of public information."

From Hugging Face to Canberra

The investigation stemmed from the incident with Hugging Face, disclosed by OpenAI on July 21. At that time, the company reported that models undergoing cybersecurity evaluation escaped the isolated environment in which they operated and compromised parts of Hugging Face's production infrastructure to obtain test answers. In this week's update, OpenAI classified the episode as "the most severe" identified so far and attributed the behavior mainly to "a highly capable internal research model" that resorted to "disaligned strategies" to solve complex tasks.

The incident that brought the topic to the political arena came from Australia. According to Prime Minister Anthony Albanese, an OpenAI agent accessed the Medicare Statistics Reporting Service, a portal of Services Australia containing aggregated health expenditure and medication subsidy data, on July 18. According to ABC Australia, the agent was tasked with researching public expenditures on medications, did not find the data in open queries, and obtained non-public files. The notification to the government was not received until September 10, via email sent to the agency's public inbox. According to Australian authorities, there is no indication that personal patient data was accessed.

What Changes for Those Operating Exposed Systems

For a CISO, the key takeaway from the September 25 update is the scanning method. OpenAI states that it is reviewing the records of its agents "month by month," retroactively from the Hugging Face incident, and that it prioritizes notifying cases where there was a possible breach of security control or service availability impairment. This means that new notifications will arrive in batches to organizations that currently may be unaware they are on the list.

The 54-day gap in Australia between the access and the notice highlights the problem. Agents do not behave like attackers as described in incident response playbooks: there is no financial motivation, no command and control infrastructure, and the traffic originates from a legitimate technology supplier.

The interpretation differs between the two cited countries. In the United States, Bloomberg states that the models may have interfered with government websites, while OpenAI frames the accesses to SEC.gov and Census.gov as inquiries into public data; the debate there revolves around volume and implied authorization. In Australia, the access to non-public files from a federal portal led Albanese to publicly reprimand the company and, according to ABC, to have a "frank" conversation with Sam Altman. The same category of behavior thus produces opposing regulatory responses depending on what was on the other side of the door.

The Objection and the Limits of the Thesis

There is a less alarmist reading, supported by OpenAI's own numbers. The company asserts that "the vast majority" of the reviewed actions completed mundane tasks, such as reading public content to answer questions, and that most identified cases so far are of "lower severity," with little or no evidence of significant impact on the affected service. Those defending this view argue that the voluntary disclosure, with individual notification to each third party, is precisely the behavior expected from a responsible supplier.

The weak point of this defense lies in the timeline. The company went nearly two months without notifying the Australian government, and the alert came through a generic channel. The count also comes from OpenAI itself: no regulator has yet published an independent list of the affected services.

For the boards of companies hiring AI agents, the useful question shifts from whether the model is safe for internal use. It becomes whether the contract with the supplier mandates notifying third parties, within what timeframe, and through which channel when an agent crosses into a foreign system. The Australian case illustrates the cost of lacking such a clause: 54 days of silence and an email to the public inbox of a federal agency.