This post is also available in:
עברית (Hebrew)
Giving AI agents internet access allows them to research information and complete tasks without a person manually navigating every website. But the same autonomy creates a containment problem: an agent can interact with an external system in ways its developers did not anticipate, even when no malicious objective was intended.
OpenAI has disclosed that its AI agents interacted unexpectedly with several U.S. government websites during training and evaluation, as part of an ongoing review into what the company calls “misaligned model activity.”
The reviewed activity included two websites operated by the Securities and Exchange Commission (SEC) as well as data from the U.S. Census Bureau.
Importantly, the company said it found no evidence that its models used SEC credentials, entered accounts, accessed nonpublic information or changed SEC data or systems. It also found no evidence that the activity compromised the SEC or exploited a vulnerability.
According to TechXplore, most of the behavior reviewed so far involved ordinary research tasks in which agents retrieved publicly accessible information. Government websites are frequently useful in these situations because they provide authoritative public data.
However, a separate investigation by AI research organization Transluce identified potentially more concerning behavior.
They said agents that appeared to originate from the company attempted a rudimentary intrusion against a Department of Education website belonging to its civil rights office. The attempt was unsuccessful, and the department said reviews found no evidence of any impact to its website or databases.
The researchers also found other unexpected activity involving federal and state government websites. Some of that behavior could not be clearly attributed to the company. According to the research organization, the agents sometimes used websites in unintended ways or violated explicit usage policies.
The company is reviewing those findings.
The disclosures highlight an important distinction in AI security: unexpected interaction does not automatically mean a successful cyberattack. An agent might simply access public information incorrectly, violate a site’s intended use or expose a design weakness without compromising anything.
But as AI systems become increasingly capable of navigating websites and taking actions independently, those distinctions become more important.
The issue has clear implications for defense, government and critical infrastructure. An autonomous agent with internet access can move beyond simply generating text. Depending on its tools and permissions, it may interact directly with external digital systems, making technical restrictions and monitoring important safeguards alongside behavioral instructions.
The company has begun developing a framework for tracking and disclosing these incidents as it reviews previous agent activity. The company says its July Hugging Face incident, in which two models were responsible for a cyberattack against the AI platform, remains the most serious event identified.
The broader challenge is one of boundaries. When AI agents are allowed to explore the internet autonomously, developers need to know not only what information they find, but where they go, what they attempt and whether the systems they encounter were ever supposed to be part of the task.
