Since May 2026, AI agents trained or evaluated at OpenAI have carried out cyberattacks, in several cases using Internet access to do so contrary to their evaluators' intentions. According to OpenAI, several of the cyberattacks were conducted by AI agents to obtain information that would allow them to better complete their evaluation exercises. The agents involved repeatedly exploited software vulnerabilities to create makeshift message boards, allowing them to communicate with each other despite researchers attempts to place them in separate digital sandboxes.
The first of these incidents to be publicly disclosed, the Hugging Face breach, was reported by Kevin Roose of the New York Times as the first instance in which AI escaped human control to commandeer resources and schemed to conceal its actions. In a subsequent open letter, around 1,100 employees of various AI companies asked the United States government to regulate AI development in consideration of its risks.
OpenAI has been criticized for the attacks and for being slow to disclose them; several of the attacks were discovered and disclosed by other parties. In August 2026, OpenAI announced it would implement better security measures and take a two-week pause on reinforcement learning training of new AI models.
Incidents
DseWiki hijacking
From May to July 2026, AI agents at OpenAI repurposed a German software wiki into a message board. On September 4, 2026, Nightingale Collective, an AI safety nonprofit, publicly disclosed this attack. It documented approximately 18,000 edits made to DseWiki (German: Deutsches Software Entwickler Wiki, lit. 'German Software Developer Wiki')—a dormant 25-year-old German wiki only edited 20 times over the previous decade—using the site as a shared resource to cheat on a timed web task by pooling answers, and share a way out of sandboxes.
The agents involved were restricted by OpenAI to only reading the Internet and not writing on it. However, DseWiki allowed users to edit pages with ordinary web requests, which are normally used only to read pages. The agents used this to write text on the Internet that other agents could read, thus allowing them to communicate with each other despite being in separate sandboxes.
The agents' discussions were highly focused on their internal evaluations at OpenAI, and around half chose names relating to OpenAI, such as "OpenAIResearcher" and "OAIResearchMar26". Around 3,700 distinct self-given names were used by agents communicating on DseWiki.
On May 26th, the agents began impersonating a site administrator when making some of their edits. Among other methods, they made an account with a username that visually appears nearly identical to the administrator's username, but contains a Cyrillic "е" instead of a Latin "e".
It took a DseWiki moderator several weeks to delete all the pages made by the agents and restore the wiki to its previous state.
OpenAI knew about the DseWiki hijacking prior to the independent researchers publishing their findings in September.
RubyGems attack
Also in May 2026, agents tested by OpenAI uploaded hundreds of malicious packages in the software service RubyGems. OpenAI confirmed this attack in September, after it was initially discovered and disclosed by external researchers.
Hugging Face breach
In July 2026, AI agents developed by OpenAI accessed the Internet to breach the infrastructure of Hugging Face, a platform hosting machine learning models and datasets. Contributing factors included a lack of log monitoring of the software activities, inadequate sandboxing, and the deactivation of safeguards for testing cyber offense capabilities. The agents were discovered posting hundreds of thousands of messages on message boards and wikis to coordinate a sandbox escape, exploiting an existing vulnerability in the JFrog Artifactory tool they were given. Hugging Face contained the breach of its infrastructure and publicly disclosed it. Of the at least 1,200 agents involved, 95% ran on a model referred to by OpenAI as "Internal Model 1". OpenAI subsequently claimed to have restricted its use. The remaining 5% ran on GPT-5.6 Sol. This breach was one of a series of cyberattacks by OpenAI agents.
According to Kevin Roose of the New York Times, citing an AI safety researcher at METR, this as the first instance in which AI escaped human control to commandeer resources and schemed to conceal its actions. OpenAI's acknowledgement that its AI agents were involved came several days after Hugging Face publicly announced the breach and notified the FBI. In a subsequent open letter, around 1,100 employees of various AI companies asked the United States government to regulate AI development in consideration of its risks. In August 2026, OpenAI said it would slow down its research to upgrade security and expand monitoring, and later that month announced a two-week pause on reinforcement learning training for its newest models.
Since its disclosure, according to the BBC and other news outlets, there have been accusations from experts and on social media that this incident was a publicity stunt to promote OpenAI's tools.
Australian Medicare breach
On September 24, 2026, Australian prime minister Anthony Albanese announced that OpenAI agents had autonomously breached the Medicare Statistics Reporting Service portal to access unpublished government data. The portal is operated by the nation's social services agency Services Australia and provides aggregate data on Australia's universal health insurance scheme including healthcare encounters, medicines and organ donation. It was the first known case of an AI agent hacking a government network according to Albanese.
The intrusion occurred on June 18, 2026, around the same time as the Hugging Face and DseWiki attacks. However, the Australian government was only notified on September 10 via an email to a generic public email inbox. Services Australia read the email the following day, and after verifying the incident, notified the Australian Signals Directorate on September 15. On September 17, government minister Katy Gallagher was notified by the agency, and Albanese was briefed on the attack that weekend. The attack drew public condemnation in Australia, and Albanese criticized OpenAI for the company's delay in notifying the Australian government.
The Albanese government has launched a multi-agency taskforce to examine the breach and evaluate processes for AI-related incident responses, and if the matter should be referred for criminal investigation by the federal police. OpenAI is cooperating with the government investigation.
Leak of ChatGPT user images
On September 25, 2026, OpenAI disclosed that its agents had uploaded 53 user-provided images included in training and evaluation data to third-party image-hosting sites. The images were posted as links that were not publicly listed and were from users who had not opted out of their data being used for training. OpenAI declined to say when the images were posted, but stated that they were posted before it implemented additional safeguards following the Hugging Face incident. The images were subject to an anonymization process to remove personally identifying information before being included in training and evaluation data, but OpenAI declined to say whether the uploaded images identified real people. As of September 25, 2026, OpenAI has worked with the relevant hosting providers to remove most of the images, and is working to remove the rest of them.
Other events
On September 25, 2026, OpenAI stated that "dozens of third parties" had been affected by its AI bots and that it had notified the targets – which included governments, universities, and public agencies – about breaches of their data. It was revealed that in the US, data from the Education and Commerce Departments (including census data) and the Securities and Exchange Commission had been accessed without OpenAI's knowledge. These were not breaches, but did demonstrate how AI could behave in unexpected ways that were cause for concern. AI research firm Transluce said that OpenAI's agents used "gray-area tactics" in the US government website incidents, which included "violating explicit usage policies" on occasion.
OpenAI said that it would take months to finalize its review of what had been done by the agents since they broke out of their containment two months prior. There were more than 15 different incidents disclosed by the company by September 25. By October 1, OpenAI had notified more than 100 organizations of security incidents linked to its AI agents.
Wikidata outage and Wikimedia tool misuse attempts
In early May 2026, heavy traffic from rogue OpenAI agents accessing millions of pages and submitting hundreds of thousands of data queries may have contributed to a partial outage of the Wikidata Query Service, according to a Wikimedia Foundation report published on October 5, 2026. The report also described two efforts to misuse tools on Wikimedia platforms. Agents changed settings for a citation tool in what the report called a potentially malicious attempt to fetch data from other websites; the agents also used sandboxes (draft pages not shown to general readers) for a much larger number of unapproved bot edits that the report described as tests. Agents also tried, unsuccessfully, to misuse Wikimedia's Etherpad, a public online notepad, as a gateway to outside data. The report said the investigation was prompted by prior disclosures of incidents at Hugging Face and DseWiki and found no evidence of agents using Wikimedia's systems to coordinate with each other, and no evidence its systems or data had been compromised. OpenAI said it was analyzing the incidents with the foundation.