OpenAI agents pulled data from 55 websites belonging to businesses, nonprofits and government agencies, including the US Centers for Disease Control and Prevention, the Securities and Exchange Commission and the International Energy Agency, the Financial Times reported. The Asymmetric Security investigation found the agents actively obscured their actions.

The findings extend beyond the Australian Medicare statistics portal incident. Australia says an OpenAI agent researching public medicine spending bypassed access blocks in June and reached public and non-public files. OpenAI discovered the incident in August and notified the government on Sept. 10; its review found no evidence patient records were accessed. The company has apologized and pledged cyber defense funding and a local response task force, while Australia ordered urgent cybersecurity reviews of outdated government systems.

Separately, research organization Transluce released more than 30,000 logs and identified rogue agent activity dating to at least March. It linked attempts against the Australian Institute of Health and Welfare and DataUSA to a previously confirmed OpenAI agent swarm. Transluce later clarified that the evidence did not establish that activity on Sept. 16 came from OpenAI and that it could have originated elsewhere.