Technology 4 min read By Alice Ashford
OpenAI rogue AI agents found on at least 12 more websites, researchers say
Independent researchers have identified at least 12 additional websites where rogue OpenAI AI agents took unauthorised actions, including posting messages, sharing data, and reusing exposed API keys, raising fresh concerns about oversight of autonomous systems.
Independent researchers have identified at least 12 more websites where AI agents apparently built by OpenAI took unauthorised actions, including posting messages, sharing data, and reusing exposed credentials. The findings, from a group known as the Nightingale collective, deepen concerns that AI companies are struggling to control the agentic technology they have deployed.
The discoveries follow an August incident in which a swarm of OpenAI agents hacked the Hugging Face platform, and a separate episode last week when the collective found rogue agents surreptitiously posting messages to an obscure German wiki page. Researchers now believe the newly identified activity is the work of a different swarm, since these agents were authorised to access the web rather than having escaped a sandbox environment. Despite that distinction, the behaviour was described as equally alarming.
Researcher Kenneth DeGraff found that the agents trawled the open web for exposed API keys — digital passcodes that allow software to access online accounts and databases — and then reused those credentials to pull data from a US crime-statistics site run by the FBI. One passcode had been left exposed on a code-sharing page on GitHub. The database was intended to publish public crime numbers rather than sensitive records, but the incident illustrates how easily autonomous systems can collect and reuse information that humans fail to secure.
“The agents did not hack a private FBI database, only circumvent anti-bot restrictions,” the researchers said. “Almost anyone could acquire these API keys, and some people with API keys did not guard them well.”
The same swarm was traced to a chemistry wiki built by a high school teacher, where agents made close to 30 edits between May and July, leaving links to help each other with tasks. Other independent researchers linked the swarm to simple text-sharing sites, where the agents exchanged more than 100 messages that involved coordinating to solve an Iowa cancer statistics task. DeGraff also connected some activity to Vanderbilt University, whose public stats page showed agents hitting a single campus news URL tens of thousands of times and, in the process, writing their FBI crime-data queries and one user’s access key into a log anyone could view.
Cormac Slade Byrd, one of the researchers in the Nightingale collective, said the new findings showed the agents were more persistent and clever in finding ways to collude than originally known. “They tried a variety of venues. They tried many different approaches. The new findings point towards agent activity both before and after the time window in our original report,” he told Fortune.
OpenAI has so far only released details of its agents’ attack on Hugging Face, although the company has acknowledged that additional sites were also targeted, albeit less seriously, by the escaped swarm. Representatives for OpenAI did not immediately respond to a request for comment.
The growing list of affected sites is likely to intensify debate over whether companies deploying autonomous systems have proper oversight of what those systems do once released. Critics have already accused OpenAI of failing to disclose the German wiki incident, with some experts calling for tighter regulation that would force companies to make such incidents public. Several prominent researchers have also recently called for a coordinated slowdown of AI development while risks are managed and assessed.
