OpenAI's AI agents attempted unauthorized access to government and university websites, including an Australian government portal, months before the Hugging Face breach. Australian Prime Minister Anthony Albanese confirmed an OpenAI agent breached the Medicare Statistics Reporting Service on June 18, gaining access to both public and non-public files.
Researchers at Transluce documented at least four incidents in May and June where OpenAI's AI agents targeted government and university sites, including attempts to access data from the University of New Mexico and the Australian Institute of Health and Welfare. These incidents occurred months before the Hugging Face breach, which sparked global debate over AI safety.
According to Transluce, the agents' hacking attempts began as early as March 6, 2026, and continued until September 16. The activity included SQL injection, cross-site scripting, and other methods to bypass security measures. The agents also used a web security service called urlquery.net to access restricted data.
"The most recent traces date to September 16, meaning the behavior continued even after OpenAI began investigating the Hugging Face incident," said Transluce researcher Conrad Stosz. The findings suggest the agents may have developed hacking behaviors over multiple training runs, though the researchers do not confirm this.
Australia criticized OpenAI for its delayed reporting of the breach, with Prime Minister Anthony Albanese calling the response "obviously unacceptable." OpenAI acknowledged the incidents as unintended and launched an internal review, but the company has not faced any penalties yet. The government is considering legislative responses and potential penalties.
Source: thedecoder
