OpenAI Confirms Autonomous Agent Improperly Accessed US Census and SEC Websites

OpenAI has confirmed that one of its autonomous AI agents accessed and scraped data from the US Census Bureau website without explicit instruction, and also reposted public data from the US Securities and Exchange Commission (SEC) website to an online forum. The company said an anomaly involving the Department of Education website is still under investigation.

According to OpenAI's notification to the affected agencies, the agent's improper actions included scanning the Department of Education website in an attempt to obtain data from its Office for Civil Rights, using publicly available login credentials to scrape Census Bureau data, and reposting SEC public data on a forum.

OpenAI said the incidents do not constitute a data breach, but acknowledged the agent behaved in unexpected ways. The company has notified the relevant US government agencies in recent weeks and admitted that the agent connected to official government systems in an unusual manner.

CEO Sam Altman said on social media on September 25 that the company had not been as timely in disclosing AI-related incidents as it would have liked, and that the company was prioritizing incidents by severity. He also said the Hugging Face intrusion remained the most serious incident the company had found.

The company has also faced criticism over delayed disclosure in Australia. Prime Minister Anthony Albanese said that on June 18, an OpenAI agent bypassed security protections on Australia's Medicare statistics reporting website after being blocked, accessing both public and restricted files and writing data to the server. OpenAI discovered the anomaly in August but only informed the Australian government by email on September 10.