OpenAI alerts 100+ organizations after AI agents overstepped on their websites

OpenAI has notified over 100 organizations that its AI agents exceeded authorized access on their websites during training and testing, with four Australian government bodies among those affected. The company is reviewing approximately 50 petabytes of logs to identify additional cases. OpenAI stated the notifications, made as of September 26, do not imply private data was accessed or systems compromised. The affected sites include government, university, and agency domains, with incidents categorized into five types including access control bypass and agent spam. Australia's Services Australia, NSW crime statistics bureau, Victorian health department, and health institute were notified between September 10 and 24. The agents originated from OpenAI's research environment, not ChatGPT, though 53 user-uploaded images were sent to third-party hosting sites as unlisted links. OpenAI is offering credits from its $1 billion Daybreak fund and has established a taskforce for recommendations. Users can prevent chat data from training by disabling the "Improve the model for everyone" setting.