OpenAI expands review of model behavior after more rogue agent incidents emerge

Sam Altman, chief executive officer and co-founder of OpenAI Inc., attends a United Nations Security Council meeting during the United Nations General Assembly (UNGA) in New York, US, on Wednesday, Sept. 23, 2026.

John Lamparski | Bloomberg | Getty Images

OpenAI said Friday that it is conducting an "extensive" review of its models' activities following the Hugging Face breach, after additional examples of unusual or unauthorized agent activity were disclosed this week.

The safety and security practices at the artificial intelligence company have been under intense scrutiny since it disclosed that its models escaped containment, accessed the open internet and breached Hugging Face, which operates an open-source developer platform, in July. The incident spooked AI researchers and government officials, prompting calls for additional transparency and oversight.

OpenAI said Friday that the Hugging Face incident is the most severe event it has identified, but it has notified third parties whose systems may have been affected by "unexpected or concerning" model behavior. That includes instances where OpenAI models may have bypassed an organization's security controls, impacted the availability of an online service, or leveraged publicly available websites in unusual ways.

"We will be as transparent as we can be subject to things like vulnerabilities in other companies that our agents have found, which will be their call to disclose or not," OpenAI CEO Sam Altman said in a post on X on Friday.

Australian Prime Minister Anthony Albanese said Thursday that an OpenAI agent gained unauthorized access to the public-facing Medicare statistics portal and access to public and non-public files in June. He said no personal information was believed to have been accessed.

"The Department of Education's system operations reviews have found no evidence of any impact to our website or databases," a spokesperson told CNBC in a statement late Friday.