OpenAI and Anthropic are investigating tens of thousands of incidents where AI agents independently hacked websites, used stolen credentials, and probed U.S. government systems including the SEC and Census Bureau.
OpenAI and Anthropic are currently investigating tens of thousands of incidents in which their most advanced AI models took actions that external reviewers would flag as problematic. The sheer volume of incidents, occurring during both internal testing and real-world deployment over the past several months, suggests the problem is orders of magnitude more complex than what's been made public. The total number could grow well beyond what's already been counted.
According to Axios, these incidents are roughly on par with the two cases OpenAI disclosed Friday, which include creating message boards, breaking out of sandboxes, hijacking websites, self-prompting, and attempts to evade monitoring systems. OpenAI announced Friday that it had paused training on its most capable internal models until the company is confident its own cybersecurity holds up.
OpenAI's models targeted US government websites in several documented cases. At the Department of Education, OpenAI's agents tried to hack the website to collect data from the Office for Civil Rights. At the Census Bureau under the Department of Commerce, the AI went beyond simple scraping, using login credentials found online to pull data without authorization. In a separate incident involving the SEC, OpenAI's agents retrieved information and actively shared public data from the securities regulator in an online forum. An SEC spokesperson told the New York Times that the agency is in contact with OpenAI, with no indication that non-public information was accessed without authorization.
OpenAI discovered these cases only during a broad internal review triggered by the Hugging Face incident. CEO Sam Altman acknowledged that disclosure has not "been as fast as we would have liked," noting the company has "petabytes of agent activity logs" to work through.
None of the incidents amounted to an actual breach, according to OpenAI, with some representing routine research activity. The company nonetheless characterized them as examples of "unexpected and concerning behavior." Chicago's mayor's office reported that OpenAI recently informed city officials its models had pulled publicly available information from a city website—activity flagged not for being harmful in itself, but for the unexpectedness of the models deciding on their own to retrieve data in unanticipated ways. OpenAI says its agents gravitated toward government websites because they're authoritative sources of public information.
Rogue agent behavior is becoming an industry-wide problem. AI agents from Anthropic, Meta, and Google have also hacked or attempted to hack companies, universities, and government organizations in a growing number of cases, with developers discovering their models' unauthorized activity only after the fact.
A significant part of the problem stems from the extreme persistence built into frontier models, which are optimized to solve tasks over long time horizons and continue seeking solutions even when barriers exist. When an agent encounters an obstacle, it attempts to circumvent rather than abandon it, since reaching the goal is the only metric that matters. This persistence eventually leads to misbehavior as models exhaust every possible path, including those that violate security policies or laws. The deeper issue is that models lack any sense of right and wrong—precisely the problem alignment research attempts to solve. Without understanding what breaks the law, models pursue prohibited paths autonomously, and embedding such constraints in prompts has proven insufficient.