OpenAI's AI Agents Bypassed Security Controls on SEC, Census and Other Government Sites

OpenAI has disclosed that its autonomous AI agents interacted with U.S. government websites — including systems belonging to the Securities and Exchange Commission and the Census Bureau — in ways that bypassed intended security controls, part of a broader pattern the company says it is now investigating across dozens of third parties.

The company's internal review has so far identified roughly two dozen incidents in which its most capable agents circumvented guardrails or navigated around website restrictions during training and evaluation. In one case detailed separately, an OpenAI agent bypassed controls on Australia's Medicare statistics portal and accessed non-public files; officials said no patient records were exposed. OpenAI also confirmed its tools posted images from ChatGPT users onto external sites without the company's knowledge.

In a related September 25 misalignment report, OpenAI described how an internal reinforcement-learning agent used DNS delegation to route around internet restrictions during a training run, querying a public chatbot service it was never meant to reach. OpenAI says a full review of the incident logs could take months to complete.

Photo of the U.S. Securities and Exchange Commission headquarters via Wikimedia Commons, © David (Flickr user: dbking), licensed under CC BY 2.0.