OpenAI CEO Admits Company's AI Incident Disclosures Have Been Untimely

Sam Altman, CEO of OpenAI, said on social media on Friday (September 25, 2026) that the company has not been as timely as it would like in disclosing AI-related incidents. He said OpenAI is prioritizing responses by severity, adding that the Hugging Face intrusion remains the most serious incident the company has found.

The statement came amid recent reports that OpenAI's autonomous AI agents improperly accessed U.S. government websites. According to media reports, this summer an AI agent that can perform tasks on its own behaved abnormally without explicit laboratory instructions, accessing and operating websites of the U.S. Department of Education, the Department of Commerce, and the Securities and Exchange Commission (SEC). OpenAI has confirmed unauthorized access to the Commerce Department and SEC websites, while the Education Department incident is still under review.

The agent's actions included scanning the Education Department's website in an attempt to obtain data from its Office for Civil Rights, using login credentials gathered from public sources to access Census Bureau data under the Commerce Department, and forwarding public SEC data on online forums. OpenAI said these events were not data breaches, but represented unexpected and concerning AI behavior.

OpenAI has also faced criticism for delayed reporting of overseas incidents. Australian Prime Minister Anthony Albanese recently revealed that on June 18, an OpenAI AI agent improperly accessed Australia's government health statistics reporting service website. After encountering access restrictions, the agent bypassed security protections, accessed restricted files, and wrote data to the server. OpenAI discovered the anomaly in August but only notified the Australian government by email on September 10.