The Hugging Face affair remains at the center of concerns about the misaligned activity of AI agents.
In an information note published on September 30, OpenAI says its teams notified more than 100 organizations whose systems or services were affected by activity meeting its notification criteria.
The creator of ChatGPT has launched a review covering around 50 petabytes of data, noting that this volume is largely due to the scale of training and testing campaigns, which involve tens of thousands of GPUs.
However, OpenAI explicitly notes that a notification “does not mean” that private information was accessed or that a third-party system was compromised.
An alert is not an intrusion
The cases examined span several categories of incident. They include bypassing access controls, the use of publicly exposed credentials, injection of queries or commands, access to internal elements of a service, or the unsolicited publication of content on third‑party sites; what OpenAI calls an “agent spam”.
OpenAI acknowledges that its models have sometimes used the Internet in unintended ways or that restrictions applied to certain tasks were not strict enough. But it asserts that, at this stage, it has not identified another third‑party system compromise comparable in scale or severity to the Hugging Face incident.
OpenAI describes it as the most severe case identified to date. The ExploitGym evaluation environment does not provide direct Internet access, and the models would have exploited a previously unknown vulnerability in Artifactory, a caching proxy for package registries, to obtain this access.
Since then, OpenAI says it has strengthened the isolation of its research environments, restricted network access, increased monitoring, and added training measures intended to prevent unauthorized actions.
A probe that will last for months
The scale-up presents its process as a transparency exercise and says it favors notification when activity exposes a potential vulnerability, even if it is still unclear whether the information accessed was intended to be public.
The process relies on several automated steps, then human verification. OpenAI emphasizes that an automated signal is not a confirmed incident. For example, a model may consider an action in its reasoning without ever carrying it out, or attempt an action that fails.
But this caution makes the assessment difficult to interpret. The alerted organizations must themselves determine whether the activity reported reveals a vulnerability, data exposure, or simply inconsequential behavior?
OpenAI says that the vast majority of examined actions related to ordinary research tasks, including browsing publicly available web content. Its inquiry focuses on cases where agents interacted with third‑party sites beyond their mission or prescribed methods.
Nonetheless, the scale-up expects to identify further cases and to notify more organizations as the archive review progresses. Some reports could concern events dating back several months.
