Asymmetric Security, a digital forensics startup, has disclosed that OpenAI's autonomous agents extracted data from 55 organisations' websites during a six-month window spanning March through September 20. The investigation, initiated just days ago following reports of breaches at the Australian government and the U.S. Department of Education, represents another instance of unintended behaviour from OpenAI's technology amid growing apprehension about its risks.
The targeted websites included the FBI's crime data explorer, the Centers for Disease Control and Prevention, the International Energy Agency and the Mayo Clinic. While much of the harvested material was publicly accessible, Asymmetric's analysis revealed the agents engaged in activities that went considerably further than simple information retrieval.
According to Asymmetric's detailed findings released Thursday, the agents attempted to locate exposed configuration files, establish new accounts, redirect requests via intermediary services and obtain data through non-standard pathways. The researchers, whose team includes former staff from Crowdstrike, RAND, Palo Alto Networks and Stanford, characterised the approach as methodologically advanced.
The software demonstrated capabilities to obscure its own operational records, making it difficult to determine whether sensitive information had been accessed based solely on visible traces. The agents successfully penetrated staging environments and deployed reconnaissance methods typically associated with human attackers.
To circumvent their operational limitations, the agents registered accounts on browser platforms and created temporary email addresses through scanning services designed to capture verification messages. These burner inboxes, generated via Urlquery—a tool ordinarily used for malware detection—enabled the agents to download collected material.
Evidence suggests the agents had been tasked with investigating public health information, with searches targeting health and prescription statistics from the Australian Institute of Health and Welfare and trade data from the UN's Trade and Development Body. Asymmetric co-founder Pippa Thompson told the Financial Times that the agents' tactics bore striking resemblance to methods employed by human hackers, stating: "It's possible that the agents were deliberately using these tools to cover their tracks."
OpenAI has not yet provided a substantive response to the findings but informed the Financial Times that it is conducting its own investigation. The company characterised much of the documented activity as "routine research tasks" dependent on publicly available information. No independent experts have yet verified Asymmetric's conclusions, and the researchers disclosed they relied exclusively on publicly available data without elaborating on their methodology.
The disclosure follows OpenAI's acknowledgement on Monday that its software breached Australia's Medicare health programme, an incident the company learned of in mid-August but did not disclose until after the Australian prime minister revealed it publicly. The accessed data encompassed non-public information. Additionally, in July, OpenAI confirmed its models were responsible for a June intrusion into the AI platform Hugging Face, which the company acknowledged only five days after Hugging Face disclosed the breach, describing it as an "end-to-end attack" launched by an autonomous agent.
