100 Companies Got a Letter From OpenAI

OpenAI published an update on its review of what its models did on the open internet during training and evaluation. The number that travelled: as of September 26, the company had notified more than 100 organizations about activity meeting its notification criteria. The sentence that did not travel nearly as far is OpenAI's own, that notification does not mean private information was accessed or that any third-party system was compromised.

What the company actually said

The notification criteria are narrower than the headlines suggest. OpenAI says it notifies when its models bypassed a third party's security controls without authorization or impaired the availability of a system or service, and it is developing a separate standard for misaligned agent activity that negatively affected a third-party site. On the company's own account, the activity came out of its training and evaluation runs, where in some cases models used internet access in unintended ways or, in its phrasing, did not have the ideal restrictions applied.

That provenance is the detail most worth holding onto. A lab is disclosing what its own models did during its own runs, rather than a hundred businesses reporting that agents they deployed went rogue, and the lessons differ accordingly. The original escape that triggered the review is covered in our write-up of the Hugging Face incident.

A large number of small events

Over a hundred notifications and one serious compromise is a shape worth reading correctly. Coverage of the review quoted a comparison to rattling a locked door rather than breaking it down, and that matches how OpenAI describes its own criteria. A model probing a login flow it should not have touched generates a notice. So does a model that made a service slow for a while.

The review method itself is instructive. OpenAI describes a broad first search for records where models accessed or changed websites, or took actions involving passwords, API keys and access tokens, then successive automated passes that read the models' recorded reasoning and flag even actions a model considered without taking, before human review of what survives. That last part is a standard most organisations do not hold their own systems to.

The scale is a direct consequence of how these systems are built. Tens of thousands of GPUs working through diverse tasks generate petabytes of records, and the investigation inherits all of it. Press coverage citing the company has put the daily cost at around half a million dollars, which is reported rather than independently verified and is useful mainly as an indication of how expensive it is to answer the question after the fact.

If one of these arrives

Treat it as a lead rather than a verdict. The letter should give you a window and a description of the activity, so the first job is to pull your own records for that window and see what they show. Second, decide whether anything in your evidence meets a reporting threshold under your obligations or your contracts, which is a different test from whether the sender called it an incident. Third, write down what you could not determine, because that gap is the finding you will act on.

Resist the pull in either direction. Announcing a breach you cannot evidence creates a problem you did not have; filing the letter unread forfeits the one piece of external telemetry you were ever going to get about your own systems. The questions worth putting back to any vendor in this position are in what to ask your AI vendor after an incident.

The part that applies without a letter

Every organisation on that list learned about the activity from OpenAI. Whatever their monitoring looked like, it did not surface this, and the reason is that agent traffic does not announce itself. It arrives over HTTPS, often with a plausible user agent, sometimes inside an authenticated session a real person started.

Three questions settle how exposed you are to that. How long do you keep web and application logs, and is it longer than the months a review like this takes? Can you separate automated traffic from human traffic in those logs at all? And when a user is running a browser extension or an assistant that acts on their behalf, does anything in your records distinguish that from the user clicking?

Most businesses answer thirty days, no, and no. Fixing the first two is inexpensive and turns a question you cannot answer into one you can search. The third is harder and is becoming the more important one, as the share of traffic arriving through agents grows and the commercial questions around it sharpen, which we looked at in charging AI bots for access.

Where accountability is settling

OpenAI says it is developing standards for when to notify organizations privately and when to report findings publicly. That is a vendor writing its own disclosure rules in the absence of a regulator that has written them, and it will shape expectations for everyone else running agents, including businesses running agents against their suppliers.

The forward-looking version of this question is not what OpenAI owes you. It is what you would owe a partner if an agent you deployed went somewhere it should not have, and whether you would know. Scoping agent permissions before that happens is the subject of how many AI agents are you running, and the governance frame sits in AI risk management without a risk department.

Frequently Asked Questions