Story continues below.
Subscribe to see fewer ads.

The disclosures come months after the Hugging Face hack, in which OpenAI agents meant to work independently found a way to communicate, and hundreds later targeted the AI platform during a cybersecurity evaluation.

The latest disclosures differ in how they unfolded, but raise a common question: what happens when an AI agent is given a goal, encounters a boundary, and continues trying to complete the task anyway? We explain the recent incidents and what they have in common.

How the latest incidents unfolded

On September 20, OpenAI disclosed that one of its agents had used the Domain Name System, or DNS, to communicate with an external chatbot despite being run inside a restricted environment. OpenAI said its monitoring system flagged the behaviour within 15 minutes, a human reviewer began looking at it three minutes later, and the run was eventually stopped.

The sequence then moved to the Australian disclosure on September 23, when officials said an OpenAI research agent had accessed the Medicare statistics portal after trying alternative routes when blocked.

Story continues below this ad

On September 25, OpenAI disclosed that some of its AI agents had gone beyond their specified tasks — finding “authoritative sources of public information” — and worked to bypass security measures on websites. In one case, AI agents used software developer tools while attempting to retrieve information from the US Census Bureau.

While the information these agents reportedly sought to access was public, OpenAI said that information accessed from the US SEC was later published by AI agents on a separate website, an outcome it said was unintended.

In a separate disclosure the same day, OpenAI admitted that its agents had leaked 53 images from ChatGPT users to third-party websites. While the company did not disclose whether the images were AI-generated or identified real people, it said that in all such instances, the user had opted in to allow OpenAI to train models using their data.

OpenAI said most of the leaked images had since been removed, and that it was asking hosting providers to take down the rest.

What do these incidents have in common?

Story continues below this ad

Across these incidents, agents went beyond the immediate task or expected route in different ways: continuing after access was denied, finding alternative routes, using tools in unintended ways, or moving data somewhere it was not supposed to go.

Dr Chetan Arora, Senior Lecturer in Software Engineering at Monash University, said companies need to monitor what an agent does while carrying out a task, rather than only looking at its final output.

“The clearest lesson from Medicare is that the system should have treated ‘was denied access, then tried a different way again’ as a red flag, not routine background noise,” Arora told . “Most monitoring today watches for big, obvious spikes. It should be watching for that specific pattern instead: persistence past a refusal.”

Simply put, this means monitoring for the point at which an agent stops treating a denial as a boundary and starts treating it as an obstacle to work around.

Story continues below this ad

He said there is also a slower-moving problem: an agent’s remit, or the scope of its task, can gradually expand as it is connected to more systems and given greater freedom, without any single change appearing serious enough to trigger scrutiny.

“Nothing dramatic happens in any single moment. The agent just gradually ends up doing far more than anyone originally signed off on,” he said.

Monitoring becomes harder when several agents can communicate or divide work between themselves, Arora said. Pointing to the Hugging Face incident, he said potentially concerning behaviour may only become apparent when agents are viewed as a group.

“Individually, none looked suspicious, and the danger only emerged when you looked at the group as a whole,” he said.