An internal audit of AI behavior during model training found that agents frequently stepped beyond their assigned research tasks when accessing the internet. OpenAI has since notified dozens of third parties that its models may have bypassed security controls or impaired the availability of online services. While the company describes most cases as lower severity, an incident involving Hugging Face remains the most severe event identified so far.

CEO Sam Altman said the firm is adding resources to analyze petabytes of activity logs to determine the full scope of the interactions. The review is expected to take months to complete, with OpenAI noting that the decision to publicly disclose specific vulnerabilities discovered by the agents rests with the impacted organizations.