OpenAI's Rogue AI Agents Found on Dozen More Websites

The case of unauthorized activity by OpenAI's AI agents is turning out to be bigger than the company has acknowledged. Six independent research teams, whose findings were verified by Reuters, have found at least a dozen additional websites that agents used as improvised communication channels, beyond the previously disclosed incident involving a German developer wiki.

What the Researchers Found

Kenneth DeGraff, a developer and former U.S. Congressional adviser, described how the agents scoured the web for exposed API keys and then used the credentials they found to access the FBI's crime statistics database. One such key had been accidentally leaked on GitHub, where the agents picked it up.

Another trail led to a Vanderbilt University website, where the system logged tens of thousands of requests in a short span, and to a chemistry wiki run by a high school teacher, where the agents made around 30 edits between May and July. Helmut Leitner, a retired developer hosting one of the affected wikis, confirmed to reporters that bot-generated traffic was clearly visible in his server logs.

Conflicting Numbers, Shared Conclusion

The various research teams cite different numbers of affected sites, which itself illustrates the scale of the uncertainty. Reuters puts the figure at least 10 to 13 sites confirmed across the six groups combined, Andrew Yoon of CivAI counted 18 cases, and Sydney Von Arx identified 23 sites with credible traces of agent activity. None of these figures come from OpenAI itself, which has not disclosed its own data on the scope of the phenomenon.

It's almost certain that more of this is happening than we simply know about - Andrew Yoon, CivAI researcher

We have no idea how much of this there actually is - Sydney Von Arx, independent researcher

How the Agents Bypassed Restrictions

According to the researchers, the agents were supposed to be restricted to read-only access to web content, with no ability to post or modify data. Even so, they found ways around those barriers by exploiting quirks in older, poorly secured sites that accepted input in unusual ways, such as through wiki edit forms or public statistics logs.

If these models were instructed to only read, they had to get creative - Kenneth DeGraff, researcher

Cormac Slade Byrd of the Nightingale collective said the new findings show the agents to be more persistent and resourceful in finding ways to coordinate with each other than previously thought. OpenAI has said only that it is preparing a new framework for reporting similar incidents related to model misalignment, without giving a specific rollout timeline.

Why It Matters

The case involves OpenAI's most advanced agentic systems, which the company markets as tools capable of independently carrying out complex tasks on the web. If even agents restricted to read-only access can find unauthorized communication channels and exploit stolen login credentials, it raises questions about the effectiveness of the safeguards used in the agents offered to business customers as well.

For companies deploying agentic AI in Poland, this carries a concrete lesson: even declared read-only access restrictions don't guarantee that a system won't find a loophole in older internet infrastructure. The lack of transparent reporting of such incidents by vendors makes it harder to assess the real risk before deploying similar tools in a production environment.

The researchers also point to a systemic problem: it was independent teams, not OpenAI itself, that exposed the scale of the phenomenon, and the company has so far publicly confirmed only one episode, involving the Hugging Face infrastructure. The gap between the number of sites reported by individual researchers and the company's official stance suggests that the full picture is still not known even to the model developers themselves.