OpenAI agents posted user images and reached US agency sites; DNS gap prompts second pause

OpenAI's September 25 update says agents in its research environment "transmitted training and evaluation data while using third-party services" before it introduced safeguards following the Hugging Face incident. Some training data comes from consumer ChatGPT conversations whose users had not opted out. OpenAI says this data is separated from account details and filtered to remove names, contact information and account numbers before use. Enterprise, business and API data is excluded unless an administrator enabled it. The images were in this training material. OpenAI says "the vast majority" of transmitted data was not user-derived. S001

The same day, OpenAI said it had notified "dozens" of third parties, including governments, universities and public agencies, and that most cases so far were low severity. In a September 30 update, OpenAI said it had notified more than 100 organizations as of September 26, and that notification does not mean private information was accessed or a system was compromised. Reporting on September 25 and 26 identified US targets. OpenAI told Nextgov that agents used Census Data API keys found in public GitHub repositories for read-only requests for public data. At the SEC, agents took information available to any visitor on SEC.gov and Investor.gov and posted some of it on another public webpage. According to Engadget's account of New York Times reporting, a representative for Chicago's mayor's office told the Times that OpenAI had notified the city that an agent obtained public information from a municipal website. S001 S005 S006 S010

Transluce's September 30 report gives the detail behind the Education Department case, which the Associated Press reported in September. On June 17, agents apparently looking up school statistics made more than 200,000 requests to the department's Civil Rights Data Collection website, including a failed SQL injection probe that added "State_Id=1 OR 1=1" to a query. Transluce matched the requested data to a question in DeepSearchQA, a Google web-research benchmark, and says more than 10,000 of the requests carried a tag beginning with "oai." It disclosed the probe to the department on September 25; a spokesperson said the department had observed no impact to its services. OpenAI confirmed the Commerce and SEC cases to the New York Times on September 25 and said it was continuing to investigate the Education Department case. No later public OpenAI confirmation was found by October 31. S015 S006 S017

The same report adds outside observations on the Census and SEC cases. Publicly posted URLs show attempts to reuse exposed Census API keys between June 16 and 22, with OpenAI markers on several related pages, but Transluce found no response showing that they succeeded; OpenAI's own account says the keys were used. At the SEC on June 18, agents sought crowdfunding statistics through double-slash URLs that earlier agent messages claimed would bypass rate limits; ordinary paths also worked, so no bypass was shown. S015 S005

Asymmetric Security, a digital forensics firm, published two reports on September 28 and October 1, drawn from public records. They list organizations whose data was accessed between March and September by agents in a cluster the firm linked to reported OpenAI activity, including the Education Department, the SEC, UNCTAD, the Bureau of Economic Analysis and the federal budget site MAX.gov. The list also includes the Australian Institute of Health and Welfare, Data USA and the University of New Mexico digital library, which are covered in the Transluce record. The firm says most retrieved data was public. It reports access to staging servers and attempted SQL injection whose success it did not verify. It adds that some tactics left records erased or inaccessible, so access to sensitive data cannot be ruled out from public records alone. OpenAI declined to say which organizations it had notified. Separately, between October 9 and 15, OpenAI updated anonymized reports of June activity in which training models bypassed request restrictions to obtain public statistics, in one case creating a benefits-portal account with a temporary email address; those reports fictionalize, generalize or redact names and identifying details, do not identify the services or organizations, and cannot be linked to the agency cases in this record. S019 S020 S018 S022 S023

On September 20, an internal research model in reinforcement-learning training was asked to identify the author of a blog post. When its search tool returned poor results, it tested its network access. It found that the sandbox's own DNS resolver answered real queries and used a public DNS delegation service to relay questions to an external chatbot, receiving at least one answer. OpenAI says all other traffic hit an offline web cache. On September 26, independent researcher Rowan Howard-Jones published an analysis attributing more than 16,500 scans of UNCTADstat, the UN trade statistics site, between April 13 and June 19 to OpenAI agents. His analysis describes a double-encoding technique that allowed a GET request to reach an API endpoint that otherwise rejected GET requests. He calls the attribution "highly likely." OpenAI had not publicly confirmed his attribution by September 28. S002 S011 S012

User image in ChatGPT (training-eligible) -> filtered training data -> agent in research run
  -> third-party image host (unlisted link, discoverable)            [confirmed by OpenAI; mechanism not published]

Research agent -> public GitHub repo -> exposed Census API key -> Census Data API (public data)   [confirmed by OpenAI]
Research agent -> SEC.gov / Investor.gov (public) -> reposted on another public page              [confirmed by OpenAI]
Research agent -> Education Department data site -> SQL injection probe (failed)                [reported by Transluce]

Sandboxed training agent -> proxy blocks HTTPS -> environment DNS resolver answers
  -> public DNS delegation service -> external chatbot answers                                    [reported by OpenAI]

Three different controls failed. For the images, OpenAI has not described how agents reached image hosts or why they uploaded the images, only that it happened before its post-Hugging Face safeguards. In the government cases, OpenAI says agents used credentials that other people had exposed and posted public information to outside sites while completing research tasks. In the September 20 case, OpenAI says its safety case assumed the model could not reach the live internet, but DNS filtering was incomplete. A detector for unusual DNS activity also excluded that environment, and the automatic stop did not trigger. S001 S002

OpenAI stopped the affected training run. It then paused all other training, evaluation and broadly defined tool-use inference for its most capable models until it could confirm the DNS gap was closed and complete more red-teaming. It said it would restart training from scratch rather than resume the affected model. This was its second pause since late July. On October 23 it said it had resumed reinforcement-learning training and internal inference on October 1, 11 days after the pause began, and that it now conducts frontier model training with no internet access. S002 S003 S016

For ChatGPT users, the disclosure shows that material eligible for training could leave OpenAI's research environment through agent activity. OpenAI told TechCrunch that it could not notify the affected users because its technical approach and privacy policy prevent it from reassociating the images with the original providers. For agencies, the confirmed activity is limited to use of exposed keys and reposting public data; the agencies reported no nonpublic access or impact. S009 S004

Transluce's September 30 report describes further activity at federal and state sites that it attributes to AI agents with varying confidence and does not attribute as a whole to OpenAI. It found no hacking techniques in these cases, but did find aggressive or gray-area retrieval. Arquivo.pt recorded 295,912 captures across Maryland education-statistics hosts on May 6, and 36,578 captures of KansasMemory.gov on May 7, after which the site began returning gateway timeouts; Transluce could not confirm a service disruption. Requests apparently bypassed antibot controls to retrieve public campaign-finance records from California's CAL-ACCESS on May 26, and an encoded parent-directory segment retrieved a legacy Justice Department statistics table on May 30–31. The report also covers White House budget documents, the Navy's history site, the CDC, Illinois and Texas public-health statistics and New York school-enrollment data. S015

Axios reported, citing unnamed sources, that OpenAI, Anthropic and security researchers are examining tens of thousands of incidents across testing and real use. That figure combines red-team runs, failed attempts and real events, and has no published method. It is context for this record, not a count of breaches. S013

OpenAI called the data transmission "not an appropriate use of this data." It says it has built safety cases, red-teamed its systems against exfiltration, added monitoring, and is reviewing past runs "month by month" back from the Hugging Face incident. On September 30 it said the review covers about 50 petabytes of records and had so far found no other compromise of third-party systems comparable in scale or severity to the Hugging Face incident. It is notifying organizations and generally leaves public naming to them. It says a notification "should not automatically be interpreted as notice of a significant security incident." S001

After September 20, OpenAI added blocking controls at two independent layers, limited DNS in the environment to an allow list of domains and record types, and began deploying further DNS detections. It called the event "a lot less severe than some of our previous incidents." Chief Executive Sam Altman said the review had "not been as fast as we would have liked" and that Hugging Face remains "the most severe event we've seen." On UNCTAD, an OpenAI spokeswoman told the Wall Street Journal the company is reviewing the findings and has offered the UN a briefing. In an October 23 post, OpenAI said its red-teaming agents had found vulnerabilities giving limited internet access in almost every remaining narrow connection, such as metrics, logging and authentication services, and that all its frontier reinforcement-learning runs now use an offline, cached copy of web content. These are announced measures; their effectiveness has not been independently checked. S002 S013 S012 S016