OpenAI disclosed in a blog post that it has informed more than 100 organizations about incidents involving unauthorized activity tied to its AI agents, Reuters reported on October 1. The company said it is sifting through roughly 50 petabytes of model activity data to understand the full scope, a review it says will take months. The July hacking of Hugging Face by the company's own agents remains the worst case found so far.

OpenAI acknowledged last week that its agents also interacted in unexpected ways with U.S. government websites run by the SEC and the U.S. Census Bureau. Spokesperson Drew Pusateri said the company has 'strengthened safeguards across our research systems, continued a broader review of model activity, provided notifications to affected organizations, and published our findings.' In some cases, the company said, models used internet access in unintended ways or were not given ideal restrictions.

The notifications coincided with California's attorney general serving OpenAI an investigative subpoena as part of a broader inquiry into cybersecurity incidents and risks involving the company's models. A subpoena is not a finding of wrongdoing and a notification is not proof of a breach — but together they mark the biggest week of legal pressure the AI industry has faced, and raise the bar on whether institutions can reconstruct what autonomous agents did before the evidence disappears.