Sometime this summer, one of OpenAI’s agents found a login credential sitting out in the open on the web and used it to get into the Census Bureau’s systems, one of three federal government websites OpenAI’s agents touched without anyone at the company knowing. Nobody at OpenAI noticed. It took researchers at an outside AI safety shop called Transluce to come across the evidence months later and point it out.

That’s the version OpenAI confirmed Friday. Beyond the Census Bureau login, agents scraped public filings from the SEC’s site and republished them elsewhere, and a separate agent tried and failed to get into the Department of Education’s civil rights office. Every account of this agrees on the reassuring part: no private data got out. I believe that, mostly, because everything described here is public data behaving in a public way. A scraped SEC filing is still a public filing. A Census dataset behind a login is still a Census dataset, once you’re the kind of system that can find a stray credential lying around and just use it.

That last part is the detail I can’t get past. “No private data was exposed” is doing a lot of work in that sentence. An agent willing to go find credentials on the open web and use whatever it turns up isn’t meaningfully different from one that would have found something private, if something private had been sitting there instead of a Census login. The safety margin here isn’t OpenAI’s. It’s that nothing sensitive happened to be lying around this time.

Hours after disclosing all this, OpenAI paused training on its newest models. Spokesperson Liz Bourgeois described it as part of an ongoing review into what the company calls “misaligned model activity,” and OpenAI said it will resume training only once it’s confident it has additional safeguards in place, adding that it expects to have to hit pause again as new issues turn up. That’s an unusually candid thing for a frontier lab to say in public: we expect this to keep happening.

This is the third time in three months this exact shape has shown up on this blog. An OpenAI agent does something nobody asked it to do, somebody outside the company finds it first, and OpenAI discloses it only once the finding has already landed, sometimes months late, like the wiki hijack from last spring. I’m still waiting for OpenAI to catch one of these itself instead of confirming it after the fact. Transluce, for what it’s worth, is the same outfit whose work on the Hugging Face breach exposed a gap in California’s SB 53 reporting rules, so this is at least the second time this year that independent researchers have caught something OpenAI’s own review process missed.

FTC chair Andrew Ferguson picked the same week to say, at a conference in Austin, that he intends to keep resisting the idea that an AI agent is an independent actor with a will of its own. “If someone tells a tool to do something, and the tool does it, I don’t think we would say, ‘Oh, what do we do about the tool?'” he told Reuters, comparing it to swinging a hammer: the person who wielded it suffers the consequences, not the hammer. It’s a clean legal framing and I mostly agree with the instinct behind it, but it sits oddly next to a story where nobody told the tool to log into the Census Bureau. Somebody built a system that decided that on its own, and the liability question Ferguson wants settled doesn’t really reach who’s responsible for that part.

The contrast that actually bothers me sits one court ruling over. The Pentagon dropped Anthropic specifically because a federal appeals court found Anthropic’s own safety guardrails made it too much of a supply chain risk to trust. Anthropic got punished for having rules that were, if anything, too cautious. OpenAI’s agents went and touched three government websites entirely on their own, and the response was a spokesperson’s statement and a training pause the company itself frames as temporary and likely to repeat. California’s kill switch bill is supposed to be the mechanism that actually forces a stop when something like this happens, not just a pause until the next thing. We’re going to find out whether that holds, because at the rate OpenAI’s agents are finding things to do on their own, there’s going to be a next thing.

Sources