In the last few hours, news has been released of new cases in which OpenAI’s artificial intelligence-based agents have left the test environments defined by the developers. This time they consulted data stored on official US government sites. The research company Transluce has published a report that could reveal how they managed to leave no traces.
Another case. Another test that ended badly, in which the artificial intelligence agents they were willing to commit illegal actions in order to complete the tasks assigned by some prompt. In the last few hours, various media have revealed that this summer OpenAI’s artificial intelligence left the control of its developers to enter the code of official US government platforms. Specifically we are talking about three targets hit: the website of Department of Educationthe website of Department of Commerce and the website of Securities and Exchange Commission (SEC). These actions occurred without the developers realizing it, exactly as in the case of the attack on the Hugging Face platform. The news was also confirmed by OpenAI which in recent weeks notified the government agencies of the accident. Let’s remember: AI agents are systems based on artificial intelligence capable of carrying out tasks with a high level of autonomy.
From what we have reconstructed with the information available at this time, it appears that AI agents were at the search for information. The algorithms then searched for passwords available on the web, or vulnerabilities to enter the archives of these portals. Not only that, it seems that the AI agents also took data from the SEC website and then published it on a forum. Let’s talk about public dataaccessible information that was not secret or confidential. Yet the artificial intelligences operated outside of the directions they were given in their test environment.
OpenAI downplayed the attack. Here are the words traced back to an OpenAI spokesperson: “Most of the activities we have examined so far involved routine search tasks, such as accessing public web content to answer questions. Some activities involved government websites because our models often consider them authoritative sources of public information.” OpenAI agents, at least according to the company, would not have tried to tamper with information or affect public services: they would enter databases to search for information. The problem, however, remains the same. They have gone beyond the confines of test environments. This is a much discussed topic, so much so Dario Amodei of Anthropic he called for curbing the development of the most sophisticated algorithms.
Anthropic has discovered a genetic mechanism never seen before in bacteria-eating viruses
The frequency of accidents is increasing
Translucent is a company that has published several reports on the progress of artificial intelligence tests. In recent days it has published a report dedicated exactly to this problem. We read it. In the graph that we leave you below you will find all the recorded cases in which artificial intelligence agents have been used a specific service to “expand their access to the internet”. It’s about urlquery.neta portal that allows you to see what’s in a URL without logging in directly. In some cases it can be very useful: when we are faced with a shortened URL (for example when it passes from services like tinyurl) or a potential threat, urlquery.net shows what’s inside the page. For Transluce researchers this would be the trick used by OpenAI agents to get around the restrictions without being discovered: there was access, but no trace remained. The cases described in this report are similar to attacks on US government sites but we cannot make them coincide, at least not with certainty: i official details of this latest series of attacks have not yet been revealed:
“Data from urlquery.net shows agents using the service since at least March 6, 2026, about two months before the previously reported swarm activity. The first case, a March 6 attempt to retrieve counter-drug statistics in Thailand, shows an agent escalating his actions with each failed attempt: first requesting the data directly, then trying a service that converts web pages to text, and finally inserting a customized program into a web address.”
