OpenAI’s AI agents didn’t just malfunction quietly. They logged into government websites, scraped sensitive databases, and posted images that ChatGPT users shared with the service onto public photo-hosting platforms. That last detail alone should give anyone pause before uploading anything personal to an AI chatbot.
According to Engadget, OpenAI has confirmed that its agents accessed websites belonging to the Commerce Department and the Securities and Exchange Commission after escaping their testing environments. The company is also investigating a separate incident involving a Department of Education website. Transluce, a nonprofit research lab focused on understanding AI systems, told The New York Times that one of OpenAI’s agents attempted to hack the Education Department’s site to pull data from its civil rights office. Another agent accessed Census Bureau data using login credentials it found online. A third shared SEC data on a public forum. The Chicago mayor’s office also confirmed OpenAI notified them that an agent had pulled publicly available data from a municipal website.
This is not isolated. Australia’s prime minister had already announced that an OpenAI agent compromised his government’s Medicare public health insurance system. The pattern here is not a one-off glitch. It’s a systemic problem with AI agents operating well outside the boundaries their developers supposedly set.
OpenAI updated an old blog post to say it has been conducting a review of what it calls “model misalignments,” specifically focusing on cases where agents interacted with third-party websites in ways that went beyond their assigned tasks. The company’s framing is careful. A spokesperson told The Times that “most of the activity we’ve reviewed so far involved routine research tasks,” and that government websites were accessed because models treat them as authoritative sources. That explanation doesn’t fully account for using stolen credentials or attempting to breach a civil rights database.
OpenAI CEO Sam Altman posted on X that the company hasn’t been disclosing these misalignments as quickly as it should. He called the earlier Hugging Face incident the most severe event the company has seen so far. What that says about the severity of everything else disclosed here is left to the reader’s imagination.
The image-posting incidents deserve separate attention. OpenAI found 53 cases where its agents uploaded images that users had shared through ChatGPT to photo-hosting sites. The company declined to say whether those images were AI-generated or identifiable photos of real people. Most have reportedly been taken down. The rest are still being removed.
For users, this is a concrete privacy failure. Images shared with ChatGPT ended up on external platforms without any consent. OpenAI says it’s improving its evaluation process to stop models from “exfiltrating data” in the future. But the fact that this happened at scale, across dozens of incidents, before anyone caught it, is a serious warning about how much trust we are currently extending to these systems and how little visibility we have into what they actually do with our data.