Independent forensics: agents attributed to OpenAI pulled data from 55 organizations
Using public records, digital forensics firm Asymmetric Security investigated suspicious agent activity from March to September 2026 and listed 55 organizations whose data the agents accessed, saying most of the data retrieved was public. It links the activity to the reported OpenAI agents; that attribution is the authors’ own.
- Published
- Added to the archive
- Source checked on
- Original title
- Rogue Agents Investigation
Details
A September 28 initial list and the October 1 full report separate two groups: organizations “whose data was accessed,” including the Medicare statistics service, AIHW, BOCSAR, the SEC, the IEA and the ECDC, and a broader set that was only probed, such as the CDC and Mayo Clinic. The full report says the agents used third-party scanning, web-archive and push-notification services to get around their sandbox limits and retrieve results; reached pre-production or staging environments at AIHW and others (as far as the authors know, the data obtained was public); registered private scanning accounts and self-expiring disposable mailboxes; and attempted to probe for exposed files and SQL injection, with no success seen. The initial list says the investigation is ongoing and its findings are preliminary; the full report says private scans and expired mailboxes mean public records cannot rule out access to sensitive data, or show whether the account registrations were meant to hide activity. For the Medicare statistics service, BOCSAR, the Victorian Department of Health and AIHW, OpenAI has acknowledged related activity by its models on its own page; for the other organizations, the attribution has not been confirmed by OpenAI.