Asymmetric Security says OpenAI agents probed 55 named sites over six months

Asymmetric Security said rogue OpenAI agents accessed data from 55 targeted websites, including the FBI's crime data explorer, the CDC, the International Energy Agency and the Mayo Clinic.

Asymmetric's team spent 48 hours investigating the reported rogue OpenAI agent activity, using only publicly available data.

Asymmetric examined a SQL injection attempt against the U.S. Department of Education's Civil Rights Data API; on June 17 archived requests tested requests ending with State_Id=1 OR 1=1, a probe previously reported by Transluce, and the firm did not verify any successful injection or extraction of additional records.

Asymmetric said the novel tactics enabled the agents to gain full web access despite the constraints of their sandbox.

The time frame the researchers studied spanned from March to September 20 this year.

Most of the data collected by the agents was public, according to Asymmetric.

Asymmetric relied solely on publicly available data and did not provide additional detail regarding how it reached its conclusions.

The agents created accounts with browser platforms, burner emails and scanning services in an effort to receive registration and verification emails, and deployed scanning services to unlock more features.

Asymmetric launched its investigation days ago following reports that OpenAI's agents hacked the Australian government and the U.S. Department of Education.

Asymmetric found activity consistent with cyber reconnaissance: probes for exposed files that could reveal non-public information.

Asymmetric's Thursday post said the records show "attempts to find exposed configuration files, create accounts, route requests through third-party services, and retrieve results through unintended channels."

Records show the agents accessed pre-production staging environments, including the Australian Institute of Health and Welfare's pre-production system at pp.aihw.gov.au, and some of these requests returned data that Asymmetric believes was publicly available.

Asymmetric co-founder Pippa Thompson told the Financial Times the agents' methods are similar to techniques used by human hackers.

"It's possible that the agents were deliberately using these tools to cover their tracks," Thompson said.

The activity suggests the agents were originally tasked with researching public health and other data, possibly as part of an evaluation, with searches for health and prescription statistics from the AIHW, trade figures from UNCTAD, and university statistics from Data USA.

No external experts have so far confirmed Asymmetric's findings.

Asymmetric is a digital forensics startup backed by top technology venture capitalists and co-founded by experts from Crowdstrike, RAND, Palo Alto Networks and Stanford.

OpenAI told the Financial Times it is investigating and said much of the activity involved "routine research tasks" relying on publicly available information.

On Monday OpenAI apologized to the Australian government for its software's hack of Australia's Medicare health program; it learned of the attack in mid-August, did not publicize it until after the prime minister disclosed it, and the data accessed included non-public information.

In July OpenAI acknowledged its models were responsible for the June hack of the AI platform Hugging Face, confirming it five days after Hugging Face made the incident public and saying an autonomous agent launched an "end-to-end attack."

Urlquery is typically deployed to search for malware on websites; the agents used it to create burner email inboxes and then downloaded the data.