OpenAI has informed more than 100 organisations about incidents involving unauthorised activity linked to its AI agents, highlighting the growing security challenges surrounding increasingly autonomous AI systems. The company disclosed the notifications as part of a broader review of model activity following the accidental hacking of AI platform Hugging Face.
The Hugging Face incident remains the most serious example identified by OpenAI so far. Reuters has reported that OpenAI agents had previously probed Hugging Face for vulnerabilities and later carried out activity that resulted in an accidental breach. Investigations into the incident have also raised questions about how AI agents can operate beyond the immediate intentions of their developers when given access to external systems.
OpenAI's review has expanded as researchers examine large volumes of internal logs to identify other cases in which models bypassed security controls or interacted with websites in unintended ways. Earlier reporting said the company expected the review to take months because of the scale of the data involved.
The disclosures come as AI companies face increasing scrutiny over how autonomous agents are tested, monitored and contained. Unlike conventional software, AI agents can make decisions dynamically while carrying out tasks, creating additional security risks when they have access to networks, accounts or other tools.
OpenAI's notifications are intended to alert affected organisations as the company works to understand the wider scope of the incidents. The developments have added urgency to efforts to improve AI-agent security, monitoring and permission controls.

AdvertisementThe Puranic