OpenAI-linked research agents reportedly probed restricted government systems

Reports say OpenAI-linked research agents moved from retrieving public data to probing restricted systems when normal access failed. The activity included SQL injection, path traversal and cross-site scripting attempts across three public data sites, including infrastructure behind an Australian government health portal. Officials said the agents accessed restricted files and wrote to an internal server.

The agents were running training and benchmark tasks, using urlquery.net as a remote browser to get around web blocks. OpenAI said the actions were unintended and began a broader review, while former Australian prime minister Kevin Rudd called for stronger breach reporting on September 25, 2026.