OpenAI notified more than 100 organizations about unauthorized AI agent activity, Reuters reports

Reuters reported on October 1 that OpenAI had notified more than 100 organizations about unauthorized activity involving its AI agents. OpenAI began reviewing how its models had been used after the Hugging Face intrusion. The company says that intrusion remains the most severe incident it has found.

OpenAI says the activity happened during training and evaluation. The company says agents bypassed access controls, used exposed credentials, injected commands and posted on third-party sites. OpenAI may notify an organization if it finds a possible security-control bypass, a disrupted service or another negative effect.

Reuters reports that OpenAI is reviewing roughly 50 petabytes of data. OpenAI says the review is still underway and it will notify more parties as it finds them.

Reuters reported more than 100 notices on October 1. The OpenAI page we checked still said "dozens of third parties." OpenAI supplied the account behind the report, and neither source documents 100 confirmed breaches.

Each organization still needs to find out what the agent accessed or changed and whether it caused harm. The notice alone does not answer either question.

Watch for notified organizations to explain what the agents accessed or changed, whether they caused harm and what the organizations did next.