OpenAI agents used public wiki as message board, company says

The broader review has uncovered other forms of unexpected activity, such as agents interacting with third-party websites beyond their assigned tasks. Investigators found cases involving access-control bypasses and exposed credentials on websites belonging to governments, universities, and public agencies. OpenAI attributes the frequency of these institutions to research agents often being instructed to consult authoritative public sources. The company is notifying affected organizations when cases meet disclosure criteria, though a notification does not necessarily indicate a major security breach.

OpenAI also addressed claims that its agents uploaded malicious packages to RubyGems in May, stating it has not verified those specific claims and the investigation remains open. Chief Scientist Jakub Pachocki has raised concerns about the industry's ability to monitor increasingly capable models, arguing that no AI lab has solved alignment well enough to keep scaling at maximum speed indefinitely. He called for voluntary slowdowns and international coordination on advanced AI safety standards.