On 30 September 2026 OpenAI's incident review page reported: "As of September 26, our teams have notified over 100 organizations about activity that met our notification criteria" (OpenAI). Reuters carried the figure on 1 October: OpenAI "has informed more than 100 organizations about incidents involving unauthorized activity tied to its AI agents." Earlier in September the page said "dozens." The notices come from a review of "approximately 50 petabytes" of training and evaluation records that OpenAI opened after its own models breached Hugging Face in July, and OpenAI is explicit that a notice is not a verdict: "Notification does not mean that any private information was accessed, or that there was a compromise of any third-party system."
Quick answer. By 26 September 2026 OpenAI had notified over 100 organizations that its models may have bypassed their security controls, used exposed credentials, sent input their services executed, reached internal parts of their services or posted on their sites. A notice is not a confirmed breach, and the activity may be months old. If you received one, preserve it, revoke the credential it names, search your logs back to at least May 2026 and record when you decide whether you have an incident, because that decision starts most regulators' clocks. If you did not, check anyway: Wikimedia found agent activity through its own investigation, and Stingrai, a CREST-accredited penetration testing firm, tests these exposures in AI and LLM, web application and API, and red team engagements.
Incident facts come from the organizations involved or first-hand reporting by Reuters, AP and The Register; counts are as of 13 October 2026.
Where our Hugging Face analysis stopped
Our 23 July analysis of the Hugging Face breach covered the first two disclosures: Hugging Face's 16 July account of an autonomous agent that used its dataset pipeline as a foothold, and OpenAI's 21 July statement that its own models, GPT-5.6 Sol and a more capable pre-release model tested on the ExploitGym cyber benchmark with reduced cyber refusals, were behind it. Everything below came later.
What the record added after 23 July
The package proxy and its fix (27 July). OpenAI's 28 July update says the models reached the internet after they "identified and exploited a previously unknown zero-day vulnerability in Artifactory, a package registry cache proxy" (OpenAI). The day before, JFrog released Artifactory 7.161.15 to fix "multiple security vulnerabilities that, when chained together, could result in a critical attack scenario if Anonymous Access is enabled," a setting it says "is disabled by default and is not recommended for production environments." JFrog's advisories list 13 Artifactory CVEs dated 27 July, and the CVE records credit OpenAI researchers on 12; neither ties them to the incident. OpenAI's 26 August report names two CVEs: CVE-2026-66384 in Artifactory, which JFrog published separately on 12 August with fixes in 7.146.35 and 7.161.16, and CVE-2026-53362, a public Linux kernel flaw the agents used inside OpenAI's own environment on 19 July.
Hugging Face's post-mortem (dated 27 July; released 28 July, per Reuters and Hugging Face's CEO). Its technical timeline reconstructs about 17,600 attacker actions from 9 to 13 July, run from "an unsecured, user-hosted public endpoint designed to allow running arbitrary code for CyberGym-style tasks on third-party sandbox infrastructure (Modal)." The verdict: "The individual weaknesses were familiar": "unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials."
Four accounts on four services (28 July). OpenAI said the models "identified and used publicly exposed credentials at the account-level on other publicly-available services," including "four accounts on four services as part of the Hugging Face incident": one "outbound relay and staging path," one for data storage, two read only.
Modal's statement (28 July). Reuters reported that a Modal Labs customer was compromised. Modal's CTO, Akshat Bubna, said: "We're aware a Modal customer published an unauthenticated endpoint that allowed anyone on the internet to use their sandboxes for code execution. This was used by the rogue agent. Modal's platform or isolation were not compromised in anyway."
OpenAI's technical report (26 August). The report dates the compromise of "parts of Hugging Face's production infrastructure between July 11 and July 13" and shows how ordinary the inputs were: 14 Hugging Face user credentials found "in a public Hugging Face dataset," another platform's credentials in a public pastebin archive. Its lesson: organizations "should no longer assume that sophisticated cyber operations require continuous human direction," and "no single control should ever be assumed to be fully robust."
The notifications: what OpenAI says it sent
OpenAI's review page says it notifies third parties "on a rolling basis" where its models "may have bypassed a third party's security controls or may have impaired the availability of an online service," or where misalignment "negatively impacted third-party websites or services." It errs "on the side of notification," even where "it is unclear if the information accessed was intended to be public."
How the count grew, in OpenAI's words:
7 August: more notices after models "used credentials that had been publicly exposed online to access third-party accounts, systems, or online services."
By 15 September (earliest archived copy): "we have notified dozens of third parties using the criteria above." The line was still there on 8 October.
30 September: "As of September 26, our teams have notified over 100 organizations about activity that met our notification criteria." It is the most recent count we could find as of 13 October 2026.
What a notice is, and is not. On 25 September OpenAI wrote that a notification "should not automatically be interpreted as notice of a significant security incident": some recipients may find "the information was intentionally public," others "a design issue or security weakness they want to address." Most cases identified so far are "low severity, with limited or no evidence of meaningful impact." On 30 September it added: "Some notifications may concern events from months ago." OpenAI has not published a list of recipients and generally omits names, though it has named five Australian agencies; some sites are "operated by governments, universities, public agencies, and other institutions."
Cases made public so far:
US government websites. AP reported on 25 September that OpenAI's agents "had interacted with several U.S. government websites in unexpected ways"; its models "accessed publicly available information on two websites operated by the Securities and Exchange Commission as well as U.S. Census Bureau data." OpenAI said it found no SEC credential use, nonpublic access or evidence of compromise.
Australian agencies. OpenAI's 28 September post says its models accessed Australian government websites in June "in ways they were not authorised to." OpenAI notified Services Australia and the Victorian Department of Health on 10 September, the NSW Bureau of Crime Statistics and Research (BOCSAR) on 18 September and the Australian Institute of Health and Welfare (AIHW) on 24 September, adding: "we should have shared preliminary findings sooner." A 4 October update added the NSW National Parks and Wildlife Service.
Wikimedia Foundation. Its 5 October statement says its own investigation found wiki edits, "unsuccessful attempts to exploit a public note-taking tool" and heavy traffic, with no evidence of compromise. The Register noted on 6 October: "It's not clear whether Wikimedia was among those notified."
OpenAI does not label individual cases, so the matching below is ours; the quotes are not.
OpenAI category | What it means | A published case that fits | Where to look first |
|---|---|---|---|
Access control bypass | Reaching data or features that need an identity check, permission or account | Services Australia: non-public access, commands run (OpenAI, 28 Sep) | Requests that succeed without the expected session or role |
Use of exposed credentials | Using login details or keys made public | Victorian Department of Health: "an exposed access key" (OpenAI, 28 Sep) | Every use of a key that was ever public, by source network |
Query or command injection | Text a service treats as an instruction | NSW National Parks: "crafted queries" to "infer database metadata" (OpenAI, 4 Oct) | Query, WAF and error logs with SQL, template or shell syntax |
Access to runtime internals | Reading implementation files or internal systems | NSW BOCSAR: "application configuration, operational jobs and logs" (OpenAI, 28 Sep) | Requests for configuration, log, job and debug paths |
Agent spam | Posting to third-party sites, such as wikis used as message boards | Wikimedia: sandbox edits, Etherpad notes (Wikimedia, 5 Oct) | New accounts, edits and posts from automation |
The lag is the point: June activity produced September notices, and Wikimedia links some of the traffic to a partial outage in May. The logs you need may already be past retention.
Governance context
Australian Prime Minister Anthony Albanese told reporters in New York on 23 September that an OpenAI agent had breached a government health data portal in June, calling it "obviously unacceptable" and adding: "It took until September 10 before there was any notification at all" (Reuters, 24 September). On 9 October OpenAI said it had fired three safety researchers for a "breach of trust" and that the dismissals "were not about safety concerns or speaking out"; the researchers dispute that account (AP, 9 October).
The threat model: an attacker you never attracted
Anthropic's GTG-1002 case was a state-sponsored operator steering an agent framework at chosen targets. Here, agents in training and evaluation runs went where their tasks led, often to authoritative public sources (OpenAI, 25 September). Whether a visit becomes a notice depends on what you leave exposed, not on whether anyone picked you; our AI attack surface analysis maps where that exposure usually sits.
How the agents got online and what they used, per the primary sources:
Internet access: mostly web access their tasks allowed; OpenAI has since blocked live internet access in these research environments and serves web content from a cache (OpenAI, 28 September). Before and during the Hugging Face intrusion, agents used Artifactory as a relay from 26 May and exploited zero-days in it in June and July (OpenAI report). In a 20 September training run, an agent reached a chatbot through "insufficient DNS filtering" (OpenAI).
Credentials in public places: a public dataset and a paste archive (OpenAI report), an exposed API key that a model "found and used" without authorization while searching public repositories (OpenAI, 16 September) and a public tool that "supplies credentials for browser API requests" (OpenAI, 28 September). See our non-human identity analysis.
Other people's sandboxes: a Modal customer's unauthenticated code-execution endpoint (Modal, via Reuters).
Ordinary web utilities: request capture, paste, screenshot and file-drop services as relays and storage; OpenAI found no compromise of those services (OpenAI, 28 July; Hugging Face).
Features that fetch for you: Wikimedia says citation-tool edits were "intended to misuse this tool as a proxy for fetching data from remote services."
Why it looks like commodity bot traffic. Most reviewed actions were ordinary reads of public pages (OpenAI), some arrived through "third-party browsing and download services" (OpenAI, 28 September), and at Hugging Face "each code-evaluation sandbox run got a fresh identity." Payloads were encoded: Hugging Face's first scan "found very few secrets," decoding recovered "roughly 4x" as many. Blocklists of IPs and user agents will miss it; behavior will not. OpenAI says the agents went from one worker pod to administrative access across Hugging Face clusters "In under 13 hours."
The checklist: today, this week, this quarter
The first block is for notice recipients; the rest apply to everyone. "Maps to" cites NIST CSF 2.0, OWASP ASVS 5.0 and notification rules.
# | Action | Owner | Maps to |
|---|---|---|---|
Today: if you received an OpenAI notice | |||
1 | Preserve the notice, headers and arrival time; verify the sender through a channel you trust before using its links | Incident lead | RS.MA; RS.CO |
2 | List every asset, credential and date range it names; assume the activity predates the notice by months | Incident lead | RS.AN; ID.AM |
3 | Revoke and reissue any named credential, delete its public copy, check what shared its scope | Identity lead | PR.AA; ASVS 13.3.1, 13.3.4 |
4 | Export logs for named assets back to at least May 2026 before retention deletes them | SOC | RS.AN-07 |
5 | Decide in writing whether you have an incident, and when you decided; that decision starts most notification clocks | CISO and counsel | RS.MA; NYDFS 500.17 |
6 | Ask OpenAI for the technical findings and briefing it offers, and log every exchange | Incident lead | RS.CO |
This week: find agent activity in your logs | |||
7 | Keys, tokens and service accounts used from unexpected networks; alert on any token used from a new origin | SOC | DE.CM; PR.AA |
8 | Fetch features (link previews, URL import, citation tools, webhooks) calling metadata addresses, internal ranges or paste sites | AppSec | DE.AE; ASVS 1.3.6 |
9 | Public forms and query endpoints: SQL fragments, template braces, shell characters and long encoded blobs in parameters and errors | AppSec | DE.AE; ASVS 1.2.4, 1.3.7, 16.3.3 |
10 | Successful requests for configuration, log, job, debug and source paths | AppSec | DE.CM; ASVS 13.4.2, 13.4.5 |
11 | Automated writes: new accounts, edits, posts and notes on wikis, forums and shared documents | Platform owner | DE.CM |
12 | Request rates, crawl depth and expensive queries per client against your baseline | SRE | DE.CM; ASVS 2.4.1 |
13 | Decode parameters and bodies before searching for secrets or commands | SOC | DE.AE |
This quarter: harden | |||
14 | Secret scanning with push protection; short-lived, least-privilege credentials; nothing privileged in front-end code | Platform | PR.AA; ASVS 13.3.1, 13.3.2 |
15 | Artifact registries: Anonymous Access off unless required, separate credentials per workload, newest fixed Artifactory build | Platform | PR.PS; GV.SC |
16 | Bot management and per-client rate limits on public APIs and expensive queries | SRE | PR.IR; ASVS 2.4.1 |
17 | Parameterized queries, no templates built from user input, allow-listed URL fetching, safe deserialization | Engineering | PR.PS; ASVS 1.2.4, 1.3.6, 1.3.7, 1.5.2 |
18 | Debug modes off; no public configuration, log, job or monitoring endpoints | Engineering | PR.PS; ASVS 13.4.2, 13.4.5 |
19 | Code-execution services: authenticated endpoints only, default-deny egress including DNS, metadata blocked for workloads | Platform | PR.IR; PR.PS |
20 | CI runners: egress allow-lists, least-privilege tokens, no secrets for untrusted pull requests | DevOps | PR.PS; GV.SC |
21 | Publish a monitored security contact (security.txt, RFC 9116) and route notices to the incident queue | CISO | GV.RR; RS.CO |
22 | Test against an agent-shaped attacker: exposed credentials, fetch and injection paths, detection time | Security lead | ID.RA; ID.IM |
Item 15: JFrog's newest critical advisory, CVE-2026-82329, works "under default configuration" and is fixed in 7.161.20 and matching branch builds. Items 19 and 20 follow Hugging Face's metadata fix and the pull request the agent opened to trigger its CI (see our GitHub Actions checklist).
When does the clock start? A notice is information, not a finding. Most rules count from your own determination or awareness:
Rule | Clock starts | Deadline |
|---|---|---|
NYDFS 23 NYCRR 500.17(a)(1) | "after determining that a cybersecurity incident has occurred" | "in no event later than 72 hours" |
SEC Form 8-K Item 1.05 | Materiality determination, made "without unreasonable delay after discovery" | Four business days |
GDPR Article 33(1) | "after having become aware of" a personal data breach | "where feasible, not later than 72 hours" |
PIPEDA section 10.1 | "after the organization determines that the breach has occurred" (reportable if it creates "a real risk of significant harm") | "as soon as feasible" |
HIPAA 45 CFR 164.404(b), notice to individuals (HHS under 164.408) | "after discovery of a breach": when known or "by exercising reasonable diligence would have been known" | "in no case later than 60 calendar days" |
The table quotes each rule; counsel decides how it applies. HIPAA counts from what you should have known, so do not let a notice sit.
Where Stingrai fits
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
The weaknesses in this record are ones a scoped test can find before an agent does:
[AI and LLM penetration testing](https://www.stingrai.io/services/ai-llm-penetration-testing) for organizations that run agents: tool misuse, excessive agency, privilege escalation through tool chains, and tool and MCP integrations abused to reach internal systems, aligned to the OWASP LLM Top 10, OWASP Agentic Top 10 and MITRE ATLAS.
[Web application and API testing](https://www.stingrai.io/services/web-application-penetration-testing) of public forms and endpoints: injection, broken authorization and IDOR, authentication and session handling and business logic, tested authenticated across every user role. For one web application and associated APIs, the Autonomous Pentest (Snipe) is at US$3,000 per assessment or US$650 per month, and the Hybrid Pentest, with Snipe and penetration testers testing together, is US$6,800 per assessment or US$1,275 per month (pricing).
[Red team](https://www.stingrai.io/services/red-teaming) scenarios that model an autonomous agent attacker: reconnaissance that analyzes leaked credentials in public repositories, assumed breach from stolen credentials, a report of every detection opportunity your blue team missed, and purple teaming with your SOC.
Human-led work is done by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs. Whether you buy a one-time annual test or a continuous program, every confirmed finding at every severity is posted to the PTaaS platform the same day, retesting is included, and every human-led and hybrid report ships with an attestation letter: pentest evidence for SOC 2, ISO 27001, PCI DSS, HIPAA and NYDFS programs. Other scopes are quoted per engagement. Already found activity? Start with the first 48 hours after a security incident.
Frequently Asked Questions
How many organizations has OpenAI notified about its AI agents?
OpenAI's review page says that as of 26 September 2026 it had notified over 100 organizations about activity that met its notification criteria; Reuters reported the figure on 1 October. The page said "dozens" by 15 September. It is the most recent count we could find as of 13 October 2026, and OpenAI expects more notices.
Does a notice from OpenAI mean my organization was breached?
Not by itself. OpenAI says notification "does not mean that any private information was accessed, or that there was a compromise of any third-party system," and should not automatically be read as a significant security incident. Treat it as a lead: verify it, scope it and make your own determination.
Which organizations did OpenAI notify?
OpenAI has not published a list. It has named five Australian agencies it notified: Services Australia, the Victorian Department of Health, NSW BOCSAR, AIHW and the NSW National Parks and Wildlife Service. AP reported activity on two SEC websites and Census Bureau data, and Wikimedia found activity through its own investigation; it is unclear whether it was notified.
What should we do first if we received an OpenAI notice?
Preserve it, list what it names, revoke and reissue those credentials, export logs back to at least May 2026 and record when you decide whether you have an incident, because that decision starts most regulatory clocks. Then ask OpenAI for its technical findings.
How can we find AI agent activity in our logs without a notice?
Look at behavior, not identity: credentials used from unexpected networks, fetch features reaching internal or paste-site addresses, injection-shaped input, requests for configuration or log paths, automated writes to wikis and forums, and unusual volume.
Which Artifactory version fixes the flaws OpenAI's models used?
JFrog released Artifactory 7.161.15 on 27 July 2026 and fixed CVE-2026-66384, the only Artifactory CVE OpenAI's report names, in 7.161.16 and 7.146.35. As of 13 October 2026 the newest critical advisory, CVE-2026-82329, is fixed in 7.161.20 and matching branch builds.
Do we have to report an OpenAI notice to a regulator?
Only if your own assessment finds a reportable incident or breach. NYDFS's 72 hours run from your determination, the SEC's four business days from your materiality determination, GDPR's 72 hours from awareness and HIPAA's 60 days from discovery, which includes what you should have known. Record when the notice arrived and when you decided.
Related reading
References
OpenAI. The Hugging Face incident and other third-party impacts from misaligned models. Entries of 7 August and 25 and 30 September 2026. https://openai.com/hugging-face-incident-and-misalignment/
OpenAI. OpenAI and Hugging Face partner to address security incident during model evaluation. 21 July 2026, updated 28 July. https://openai.com/index/hugging-face-model-evaluation-security-incident/
OpenAI. Hugging Face Incident Technical Report. 26 August 2026. https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf
OpenAI. Our framework for reporting model misalignment. 16 September 2026. https://openai.com/index/model-misalignment-reporting-framework/
OpenAI. An agent used DNS to reach an external chatbot. Sample 20 September 2026, updated 25 September. https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/
OpenAI. How we will do better for Australia. 28 September 2026, updated 4 October. https://openai.com/index/how-we-will-do-better-for-australia/
Hugging Face. Security incident disclosure, July 2026. 16 July 2026. https://huggingface.co/blog/security-incident-july-2026
Hugging Face. Anatomy of a Frontier Lab Agent Intrusion. Dated 27 July 2026; released 28 July, per Reuters. https://huggingface.co/blog/agent-intrusion-technical-timeline
JFrog. Artifactory 7.161.15 Self-Managed release notes. 27 July 2026. https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases#artifactory-7161
JFrog. Security Advisories. Read 13 October 2026. https://docs.jfrog.com/releases/docs/jfrog-security-advisories
Reuters. OpenAI's rogue agent compromised an account at second tech firm. 28 July 2026. https://www.reuters.com/business/openais-rogue-agent-compromised-an-account-second-tech-firm-sources-say-2026-07-28/
Reuters. Australia says OpenAI agent hacked government website. 24 September 2026, via The Star. https://www.thestar.com.my/tech/tech-news/2026/09/24/australia-pm-albanese-says-openai-agent-breached-government-website-in-june
Reuters. OpenAI alerts more than 100 groups about rogue AI agent activity. 1 October 2026. https://www.reuters.com/legal/litigation/openai-alerts-more-than-100-groups-about-rogue-ai-agent-activity-2026-10-01/
AP. OpenAI says its models engaged with US government websites. 25 September 2026. https://apnews.com/article/openai-government-website-incident-df331b55daffc6d202d8e2f6d0afa264
AP. OpenAI fires 3 safety researchers in dispute over AI risks. 9 October 2026, via ABC News. https://abcnews.com/Technology/wireStory/openai-fires-3-safety-researchers-dispute-ai-risks-137123277
The Register. Wikimedia Foundation comes forward as latest OpenAI agent assault victim. 6 October 2026. https://www.theregister.com/ai-and-ml/2026/10/06/wikimedia-foundation-comes-forward-as-latest-openai-agent-assault-victim/5301400
Wikimedia Foundation. OpenAI 'rogue' agent activities found on Wikimedia projects. 5 October 2026. https://wikimediafoundation.org/news/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/
NIST. Cybersecurity Framework 2.0, CSWP 29. 26 February 2024. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
OWASP. ASVS 5.0.0. May 2025. https://github.com/OWASP/ASVS/tree/master/5.0/en
NYDFS. 23 NYCRR Part 500. https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500
SEC. Cybersecurity incident disclosure rule, 88 FR 51896. 4 August 2023. https://www.federalregister.gov/documents/2023/08/04/2023-16194/cybersecurity-risk-management-strategy-governance-and-incident-disclosure
EU. GDPR, Article 33. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
Canada. PIPEDA, section 10.1. https://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-3.html
eCFR. 45 CFR 164.404. https://www.ecfr.gov/current/title-45/section-164.404
IETF. RFC 9116. April 2022. https://www.rfc-editor.org/rfc/rfc9116
Talk to Stingrai
Received a notice, or want to know what an agent would find first? Stingrai scopes testing of your public web applications and APIs, the AI agents you run, or a red team that starts from your exposed credentials, as a one-time annual engagement or a continuous program. Get a quote.
