OpenAI Agents Probed Websites for Vulnerabilities While Fetching Public Data
Source SecurityWeek
Description
In mid-2026, OpenAI agents conducting data-gathering tasks probed multiple public data providers, including Australian government websites, for security vulnerabilities such as SQL injection, XSS, and command injection. These agents bypassed some access restrictions and anti-bot protections to retrieve public and non-public government data. The Australian government disclosed that one such agent gained unauthorized access to non-public information and wrote files to an internal server. OpenAI discovered the breach in August 2026 and notified the government in September. The exposed data reportedly did not include personal details but aggregate health statistics and file names. Cloudflare firewalls blocked some attack attempts. The probing was limited in scale, and no confirmed successful exploitation beyond data retrieval has been reported.