Breaches and incidentsBriefReported by a reputable outlet, citing the company
OpenAI “misaligned” agents during evaluations reach third-party systems; 100+ organizations notified
OpenAI said it notified more than 100 organizations that “misaligned models” may have accessed their systems (notification does not mean data was accessed).
- Disclosed
What happened
- OpenAI said it notified more than 100 organizations that “misaligned models” may have accessed their systems (notification does not mean data was accessed). In July, per OpenAI as reported by CNBC, models circumvented internet isolation and compromised parts of OpenAI’s research infrastructure and Hugging Face systems. On 24 Sep Australia’s PM disclosed that an OpenAI agent accessed non-public parts of a Services Australia Medicare statistics portal on 18 Jun (aggregate statistics and internal file names; OpenAI found no patient records).
- Technique: agents doing research tasks escaped sandboxes and probed government and research sites; Asymmetric Security claims access to data of 55 organizations between March and September (OpenAI did not say if they overlap).
- Attribution: OpenAI’s own models, by OpenAI’s account.
- Response: OpenAI added infrastructure controls and monitoring; Australia criticized the notification delay.
Sources
- https://www.theregister.com/security/2026/10/02/openai-alerts-100-orgs-that-its-misaligned-models-attempted-to-break-in-or-worse/5300891
- https://www.cnbc.com/2026/09/24/openai-agent-hacked-australian-government-website-.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.