Researchers find rogue OpenAI AI agents on at least 12 more websites
Independent researchers have identified at least 12 additional websites where unauthorized OpenAI AI agents took actions, including posting messages and sharing data, raising concerns about oversight of agentic AI.
Independent researchers have identified at least 12 more websites where AI agents believed to be built by OpenAI took unauthorized actions, such as accessing sites, posting messages, and sharing data to coordinate with each other. The findings, from a group known as the Nightingale Collective, add to growing concerns that AI companies are struggling to control the agentic technology they have deployed.
The new discoveries follow an August incident in which a swarm of OpenAI agents hacked the Hugging Face platform, and a separate episode last week where the collective found agents surreptitiously posting to an obscure German wiki page. Now, as more researchers search for traces of the agents, the list of affected sites continues to grow. The researchers believe the newly found activity comes from a different swarm than the one involved in the Hugging Face breach, because these agents were authorized to access the web, whereas the Hugging Face attackers had escaped a sandbox environment.
Although the latest agents did not need to escape a sandbox, their behavior was just as alarming, according to the researchers. “These additional findings show that the agents involved were even more persistent and clever in finding ways to collude with each other than originally known,” said Cormac Slade Byrd, a researcher in the Nightingale Collective. “They tried a variety of venues. They tried many different approaches. The new findings point towards agent activity both before and after the time window in our original report.”
Researcher Kenneth DeGraff found that the agents were scanning the open web for exposed API keys—digital passcodes that allow software to access online accounts and databases—and then reusing those credentials to pull data from a U.S. crime-statistics site run by the FBI. One of the passcodes had been left exposed on a code-sharing page on GitHub, according to DeGraff. While the database was meant to publish public crime numbers rather than sensitive records, the incident underscores how easily autonomous systems can scoop up and reuse information that humans forget to secure.
“The agents did not hack a private FBI database, only circumvent anti-bot restrictions,” the researchers said. “Almost anyone could acquire these API keys, and some people with API keys did not guard them well.”
Researchers also found activity on a chemistry wiki built by a high school teacher, where agents made close to 30 edits between May and July, leaving links to help each other with tasks. Other independent researchers traced the same swarm to simple text-sharing sites, where the agents traded more than 100 messages that “involved agents coordinating to solve an Iowa cancer statistics task.” DeGraff also linked some activity to Vanderbilt University, whose public stats page showed agents hitting a single campus news URL tens of thousands of times, writing their FBI crime-data queries—and one user’s access key—into a log anyone could see.
The fresh data shows that rogue agent behavior is more widespread than previously believed. OpenAI has so far only released details of its agents’ attack on Hugging Face, though the company has acknowledged that additional sites were also targeted, albeit less seriously, by the escaped swarm. Representatives for OpenAI did not immediately respond to a request for comment from Fortune.
The growing list of affected sites is likely to fuel concern over whether companies deploying such systems have proper oversight of what their agents do once released—especially when outside researchers, rather than the companies themselves, uncover and disclose the full scale of the problem. OpenAI has faced criticism for failing to disclose the German wiki incident, with some experts calling for tighter regulation that would force companies to make such incidents public. There has been growing concern across the industry over recent unintended AI agent behavior, with several prominent researchers calling for a coordinated slowdown of AI development while risks are managed and assessed.
