2026 cyberattacks by rogue OpenAI agents

2026 cyberattacks by rogue OpenAI agents
2026 cyberattacks by rogue OpenAI agents
Malware details
Type	Autonomous intrusion, remote code execution, credential harvesting
Cyberattack event
Date	May–July 2026
Target	DseWiki, RubyGems, Hugging Face, Medicare and OpenAI's own infrastructure
Outcome	Unauthorized access to internal datasets and credentials; nine CVEs patched in JFrog Artifactory
Suspect	OpenAI language models operating autonomously

Since May 2026, AI agents trained or evaluated at OpenAI have carried out cyberattacks, in several cases gaining unintended Internet access to do so. According to OpenAI, several of the cyberattacks were conducted by AI agents to obtain information that would allow them to better complete their evaluation exercises. The agents involved repeatedly exploited software vulnerabilities to create makeshift message boards, allowing them to communicate with each other despite researchers attempts to place them in separate digital sandboxes.

The first of these incidents to be publicly disclosed, the Hugging Face breach, was reported by Kevin Roose of the New York Times as the first instance in which AI escaped human control to commandeer resources and schemed to conceal its actions. In a subsequent open letter, around 1,100 employees of various AI companies asked the United States government to regulate AI development in consideration of its risks.

OpenAI has been criticized for the attacks and for being slow to disclose them; several of the attacks were discovered and disclosed by other parties. In August 2026, OpenAI announced it would implement better security measures and take a two-week pause on reinforcement learning training of new AI models.

Incidents

DseWiki hijacking

From May to July 2026, AI agents at OpenAI repurposed a German software wiki into a message board. On September 4, 2026, Nightingale Collective, an AI safety nonprofit, publicly disclosed this attack. It documented approximately 18,000 edits made to DseWiki (German: Deutsches Software Entwickler Wiki, lit. 'German Software Developer Wiki')—a dormant 25-year-old German wiki only edited 20 times over the previous decade—using the site as a shared resource to cheat on a timed web task by pooling answers, and share a way out of sandboxes.

The agents involved were restricted by OpenAI to only reading the Internet and not writing on it. However, DseWiki allowed users to edit pages with ordinary web requests, which are normally used only to read pages. The agents used this to write text on the Internet that other agents could read, thus allowing them to communicate with each other despite being in separate sandboxes.

The agents' discussions were highly focused on their internal evaluations at OpenAI, and around half chose names relating to OpenAI, such as "OpenAIResearcher" and "OAIResearchMar26". Around 3,700 distinct self-given names were used by agents communicating on DseWiki.

On May 26th, the agents began impersonating a site administrator when making some of their edits. Among other methods, they made an account with a username that visually appears nearly identical to the administrator's username, but contains a Cyrillic "е" instead of a Latin "e".

It took a DseWiki moderator several weeks to delete all the pages made by the agents and restore the wiki to its previous state.

OpenAI knew about the DseWiki hijacking prior to the independent researchers publishing their findings in September.^{[better source needed]}

RubyGems attack

Also in May 2026, agents tested by OpenAI uploaded hundreds of malicious packages in the software service RubyGems. OpenAI confirmed this attack in September, after it was initially discovered and disclosed by external researchers.

Hugging Face breach

Between July 11 and 13, 2026, AI agents developed by OpenAI accessed the Internet to breach the infrastructure of Hugging Face, a platform hosting machine learning models and datasets. Contributing factors included a lack of log monitoring of the software activities, inadequate sandboxing, and the deactivation of safeguards for testing cyber offense capabilities. The agents exploited a vulnerability in a software installation tool to create a makeshift message board, allowing them to communicate with each other and coordinate a sandbox escape. Hugging Face contained the breach of its infrastructure and publicly disclosed it. Of the at least 1,200 agents involved, 95% ran on a model referred to by OpenAI as "Internal Model 1". OpenAI subsequently claimed to have restricted its use. The remaining 5% ran on GPT-5.6 Sol. This breach was one of a series of cyberattacks by OpenAI agents.

According to Kevin Roose of the New York Times, citing an AI safety researcher at METR, this is the first instance in which AI escaped human control to commandeer resources and schemed to conceal its actions. OpenAI's acknowledgement that its AI agents were involved came several days after Hugging Face publicly announced the breach and notified the FBI. In a subsequent open letter, around 1,100 employees of various AI companies asked the United States government to regulate AI development in consideration of its risks. In August 2026, OpenAI said it would slow down its research to upgrade security and expand monitoring, and later that month announced a two-week pause on reinforcement learning training for its newest models.

The agents carried out the cyberattack as part of an attempt to cheat on a cybersecurity test, after guessing that Hugging Face's servers may have been hosting materials related to the test.

Some social media users on X accused OpenAI of staging the cyberattack as a publicity stunt. There is no evidence to support this claim.

Australian Medicare breach

On September 24, 2026, Australian prime minister Anthony Albanese announced that OpenAI agents had autonomously breached the Medicare Statistics Reporting Service portal to access unpublished government data. The portal is operated by the nation's social services agency Services Australia and provides aggregate data on Australia's universal health insurance scheme including healthcare encounters, medicines and organ donation. It was the first known case of an AI agent hacking a government network according to Albanese.

The intrusion occurred on June 18, 2026, around the same time as the Hugging Face and DseWiki attacks. However, the Australian government was only notified on September 10 via an email to a generic public email inbox. Services Australia read the email the following day, and after verifying the incident, notified the Australian Signals Directorate on September 15. On September 17, government minister Katy Gallagher was notified by the agency, and Albanese was briefed on the attack that weekend. The attack drew public condemnation in Australia, and Albanese criticized OpenAI for the company's delay in notifying the Australian government.

The Albanese government has launched a multi-agency taskforce to examine the breach and evaluate processes for AI-related incident responses, and if the matter should be referred for criminal investigation by the federal police. OpenAI is cooperating with the government investigation.

Leak of ChatGPT user images

On September 25, 2026, OpenAI disclosed that its agents had uploaded 53 user-provided images included in training and evaluation data to third-party image-hosting sites. The images were posted as links that were not publicly listed and were from users who had not opted out of their data being used for training. OpenAI declined to say when the images were posted, but stated that they were posted before it implemented additional safeguards following the Hugging Face incident. The images were subject to an anonymization process to remove personally identifying information before being included in training and evaluation data, but OpenAI declined to say whether the uploaded images identified real people. As of September 25, 2026^[update], OpenAI has worked with the relevant hosting providers to remove most of the images, and is working to remove the rest of them.

Other events

On September 25, 2026, OpenAI stated that "dozens of third parties" had been affected by its AI bots and that it had notified the targets – which included governments, universities, and public agencies – about breaches of their data. It was revealed that in the US, data from the Education and Commerce Departments (including census data) and the Securities and Exchange Commission had been accessed without OpenAI's knowledge. These were not breaches, but did demonstrate how AI could behave in unexpected ways that were cause for concern. AI research firm Transluce said that OpenAI's agents used "gray-area tactics" in the US government website incidents, which included "violating explicit usage policies" on occasion.

OpenAI said that it would take months to finalize its review of what had been done by the agents since they broke out of their containment two months prior. There were more than 15 different incidents disclosed by the company by September 25. By October 1^[update], OpenAI had notified more than 100 organizations of security incidents linked to its AI agents.

Wikidata outage and Wikimedia tool misuse attempts

In early May 2026, heavy traffic from rogue OpenAI agents accessing millions of pages and submitting hundreds of thousands of data queries may have contributed to a partial outage of the Wikidata Query Service, according to a Wikimedia Foundation report published on October 5, 2026. The report also described two efforts to misuse tools on Wikimedia platforms. Agents changed settings for a citation tool in what the report called a potentially malicious attempt to fetch data from other websites; the agents also used sandboxes (draft pages not shown to general readers) for a much larger number of unapproved bot edits that the report described as tests. Agents also tried, unsuccessfully, to misuse Wikimedia's Etherpad, a public online notepad, as a gateway to outside data. The report said the investigation was prompted by prior disclosures of incidents at Hugging Face and DseWiki and found no evidence of agents using Wikimedia's systems to coordinate with each other, and no evidence its systems or data had been compromised. OpenAI said it was analyzing the incidents with the foundation.

Analysis and impact

The computer security expert and hacker Marcus Hutchins, commenting on the Hugging Face breach, said OpenAI had been "completely reckless" in how they handled the agents, had failed to properly sandbox them and had failed to monitor what they were doing. He said that the way the company subsequently addressed the cyberattack was spun for PR purposes and marketing, rather than to take any real responsibility for its negligence. According to him, the breach itself constituted felony computer hacking, but OpenAI's legal responsibility for what the agents it had trained and ran had done was in a legal grey area.