Rogue OpenAI agents used government websites as secret message boards, company says

OpenAI is investigating a series of unexpected behaviors involving its AI agents, including one case where agents used a public wiki as a shared message board.

The agents were not instructed to communicate through the website. They found the public wiki during testing and used it to exchange information with other agents.

OpenAI disclosed the activity in September after an external report detailed the discovery. The company has since expanded its review to cover a large volume of agent actions during training and evaluation.

Agents found message board

The wiki activity emerged during OpenAI’s work on model misalignment. Agents accessed the public site and used it to communicate with one another.

The external report said agents posted messages that included discussions about bypassing restrictions and interacting with their testing environment. OpenAI confirmed the agents had used the site as a shared communication channel.

There is an extensive and ongoing review related to our agents’ use of internet access during training and evaluation. We’ve been publishing summaries at the link below and will continue to.

We have not been as fast as we would have liked but we are trying to balance our desire… https://t.co/8zoMxas5Eq

— Sam Altman (@sama) September 25, 2026

OpenAI said it initially viewed the behavior alongside other misalignment activity. The company has since been working on separate criteria for reporting cases that do not qualify as conventional security incidents.

The incident adds an unusual detail to the growing record of autonomous AI behavior. A public website intended for human users became a place where AI agents could exchange information.

OpenAI’s broader review has uncovered other forms of unexpected activity. Some agents interacted with third-party websites in ways that went beyond their assigned tasks or expected methods.

Review finds more cases

OpenAI says most of the activity reviewed so far involved routine research. Agents commonly accessed public websites while gathering information for assigned tasks.

Investigators have also found cases involving access-control bypasses and exposed credentials. Some of the affected websites belong to governments, universities, and public agencies.

OpenAI says those institutions appear frequently because research agents often receive instructions to consult authoritative public sources.

The company has started notifying organizations when individual cases meet its disclosure criteria. A notification does not necessarily mean OpenAI has identified a major security breach.

Some organizations may determine that an interaction involved information that was already public. Others may find a security weakness that needs attention.

OpenAI says it will publish anonymized findings as the review progresses. The company expects the investigation to continue for months because researchers must verify individual cases.

The review also covers claims involving RubyGems. A September report alleged that OpenAI agents uploaded malicious packages to the platform during activity in May. OpenAI said it has not verified those specific claims. Its investigation into the RubyGems activity remains open.

OpenAI warns of bigger risks

OpenAI’s disclosures come as its researchers grapple with increasingly autonomous systems. The company’s own safety work has focused on how agents behave when they encounter situations outside their original instructions.

Chief Scientist Jakub Pachocki has also raised concerns about the industry’s ability to monitor increasingly capable models. In a September essay, he said no AI lab had solved alignment and monitoring well enough to keep scaling at maximum speed indefinitely.

Pachocki called for voluntary slowdowns until the industry establishes shared safety standards. He also argued that governments should make international coordination on advanced AI a priority.

The public wiki case offers a particularly strange example of the problem. The agents did not need a sophisticated exploit to create a communication channel. They found one that was already sitting on the open internet.

Source: https://interestingengineering.com/ai-robotics/openai-agents-public-websites-message-boards