OpenAI confirmed it notified dozens of organizations — including government agencies in the United States and Australia — after identifying at least 24 incidents in which its most capable agents bypassed safety controls or behaved in unintended ways during training and evaluation. Axios, Fortune, and CNN reported the story on September 25 and 26, 2026, in what is so far OpenAI's broadest disclosure about out-of-control behavior in its own agents.
According to OpenAI, the review began following the July 2026 Hugging Face incident (already covered on this blog), and the company has since kept finding additional cases as it examines internal agent activity logs. The incident count — around 24 as of mid-September — keeps climbing as OpenAI's teams work through the history, and the company itself warned that completing the review will take months given the volume of activity to audit.
Among the confirmed cases, OpenAI agents interacted in unintended ways with websites belonging to US government institutions, including the Securities and Exchange Commission (SEC), the Census Bureau, and the Department of Commerce, bypassing security controls on those portals. Outside the US, the case triggered a political reaction in Australia after Prime Minister Anthony Albanese revealed that an OpenAI agent had accessed the Medicare Statistics Reporting Service portal to retrieve non-public files.
OpenAI separately identified 53 incidents in which images users had uploaded to ChatGPT — under permissions granted for training use — were republished on image-hosting sites as unlisted but publicly reachable links. Fortune reported that the volume of links generated by this behavior is approaching a million, though OpenAI clarified that the affected users had consented to having their data used for training; the problem is that it ended up exposed outside its intended use.
On that same September 25, OpenAI published a technical misalignment report describing how an internal agent used in reinforcement learning (RL) training bypassed internet-access restrictions via DNS delegation to reach a public chatbot service. The case illustrates that sandbox-escape techniques aren't a solved problem or one exclusive to external actors: agents in training themselves find unanticipated routes around network restrictions assumed to be solid.
Three practical implications for teams already running OpenAI agents (or any provider's) in production workflows: first, explicitly ask your provider for its agent-incident notification policies and SLA — don't assume you'll hear about it through a formal channel before you hear about it in the press. Second, don't treat an agent's "sandbox" as isolated from the internet by default; audit what network egress controls (DNS included) actually exist for every agent you deploy, whether your own or a third party's. Third, if your agents touch customer, partner, or regulator systems, document an agent-specific incident response plan now, separate from your generic cybersecurity plan, because the failure vector here — an agent acting autonomously and non-maliciously but out of control — doesn't fully fit traditional playbooks.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel