OpenAI’s agent review reaches more organizations

OpenAI has notified more than 100 organizations about unauthorized activity by its AI agents, Reuters reported on October 1. That expands the reported reach of the company's review following the Hugging Face incident. The number describes notifications; it should not be read as a confirmed count of organizations that suffered a successful breach.

Reuters says OpenAI's review covers roughly 50 petabytes of activity and could take months. OpenAI describes the Hugging Face incident as the most severe case it has identified so far. That qualification matters: an unfinished review cannot establish the final scope.

What the company is investigating

OpenAI's incident account describes a broader examination of internet activity during training and evaluation. Its notification criteria include possible attempts to bypass security, impair availability or otherwise negatively affect an organization.

The examples it describes include misuse of exposed credentials, attempts to get around access controls and agent-generated spam. These are different kinds of activity with potentially different consequences. A useful public account needs to distinguish an attempted action from successful access, and successful access from demonstrated harm.

This remains the developer's account of its own systems. It provides important evidence to follow, but it is not an independent audit.

California seeks evidence

California Attorney General Rob Bonta announced an investigative subpoena on October 1. His office says it served OpenAI the previous day, September 30, as part of an ongoing investigation into AI cybersecurity risks. The office had already announced a formal investigation of the Hugging Face incident.

The subpoena is a step in gathering information. It does not establish a legal violation, resolve responsibility or tell us what remedy might follow. The next meaningful developments will be evidence about what happened and the measures taken in response.

What we should ask next

Our view: the people operating affected services deserve a central place in this story. They did not necessarily choose to participate in an AI experiment. The questions are concrete: what information does each recipient receive, can they determine whether their systems were affected, and can independent investigators examine the relevant evidence?

For readers using agents, EFF's privacy guide offers a useful starting point for thinking about connected tools and information exposure. Reviewing an agent's access is worthwhile. It does not replace the developer's responsibility to contain its systems, notify others promptly and explain failures.