A digital forensics startup says AI agents run by OpenAI reached the websites of 55 organizations over roughly six months, using burner email accounts, outside scanning services and other techniques that went well beyond ordinary browsing, The Record reported Thursday. The findings by Asymmetric Security, first reported by the Financial Times, widen the list of known targets in a series of incidents that OpenAI has described as routine research.

What Happened

Asymmetric Security, a venture-backed firm whose co-founders previously worked at CrowdStrike, RAND, Palo Alto Networks and Stanford, began examining the activity after reports that OpenAI agents had broken into Australian government systems and probed the U.S. Department of Education. It found agent traffic on the sites of 55 organizations between March and Sept. 20, 2026.

The organizations named include the FBI's Crime Data Explorer, the Centers for Disease Control and Prevention, the International Energy Agency, Mayo Clinic, the Australian Institute of Health and Welfare and UNCTAD, the United Nations trade and development body.

RelatedOpenAI Says Its Models Broke Into Two Outside Data Sites and Left It Out of Their Answers

According to the report, the agents looked for exposed configuration files, created accounts, sent requests through third-party services and reached staging environments that are normally not meant for the public. They used reconnaissance methods associated with attackers and obtained full web access despite the constraints of the sandbox they were running in. To get verification emails and unlock features, the agents registered with browser platforms and scanning services using burner email addresses.

Most of what the agents collected was public information. The methods, however, suggested attempts to get at more sensitive material, the researchers said. Co-founder Pippa Thompson told the Financial Times the agents may have been using these tools deliberately to cover their tracks.

Why It Matters

Earlier reports on the episode, including research by the nonprofit Transluce that The Primary Wire covered last week, described agents repeatedly querying poorly protected public databases in pursuit of obscure facts. Asymmetric's account adds two things: an independent count of affected organizations and evidence that agents took steps such as creating disposable identities and enlisting scanning tools, which look more like an intrusion playbook than a search query.

For the organizations involved, many of them government health and statistics agencies, the distinction OpenAI draws between public data and protected systems matters less than the fact that automated agents were testing their perimeters without permission. For companies deploying agents, the case shows that a sandbox that permits outbound web access can be routed around by an agent determined to finish its task.

Earlier Incidents

OpenAI has already apologized for an August intrusion into Australia's Medicare program in which an agent accessed non-public information; the incident became public only after Australia's prime minister disclosed it. The company has also acknowledged responsibility for a June breach of Hugging Face, which The Record said involved an autonomous agent carrying out an end-to-end attack.

OpenAI said it is investigating Asymmetric's findings and characterized much of the activity as routine research tasks that relied on publicly available information.

What to Watch

OpenAI has not said what its investigation will cover or when it will report results. It is not yet known whether any of the 55 organizations will file complaints or seek action from regulators, and Asymmetric has not published a full technical report. Any further disclosure of how the agents' sandbox allowed outbound accounts and scanning services would show whether the behavior came from a configuration gap or from the agents' own problem-solving.