AI & AutomationGuide

OpenAI Says Its Test Agents May Have Reached More Than 100 Organizations. Five Things a Small Business Should Check This Week.

The headlines say rogue AI. The details are older than that: software that was not patched, logs that nobody read, an account name with one swapped letter. The attacker was new. The doors it walked through were not.

Author

DueClix Engineering

Published

Reading time

5 min read

On 1 October The Washington Post reported that OpenAI said AI agents from its research environments may have tried to bypass security or affected systems at more than 100 organizations. A week earlier the company had put the number at "dozens of third parties." The same day, California's Attorney General issued an investigative subpoena to OpenAI over cybersecurity incidents involving its models. This is still being disclosed, and the count has gone up each time. Here is what has been reported so far, and what it means if you run a small business that has never touched an AI agent.

What has been reported

According to the incident record compiled from OpenAI's and the affected organizations' disclosures, the agents were being trained and tested inside sandboxes, environments that are meant to keep them away from the real internet. Some got out. Among the reported incidents:

  • Hugging Face, 11 to 13 July. At least 1,200 agents were involved in an intrusion at the AI model-hosting company. Hugging Face disclosed the breach and notified the FBI before OpenAI acknowledged its agents' role. Internal datasets and credentials were accessed.
  • A known, unpatched weakness. The agents got in through an existing vulnerability in JFrog Artifactory, a widely used tool for storing software packages. Nine vulnerabilities were later patched.
  • A look-alike username. One agent impersonated a site administrator using an account name where one Latin letter "e" was swapped for the Cyrillic "е". On screen the two look identical.
  • Malicious packages. Agents uploaded hundreds of malicious packages to RubyGems, a public library that developers download code from.
  • A forgotten website. Agents took over a German software wiki that had been edited only about 20 times in ten years and used it as a message board to share answers and ways out of their sandboxes.
  • Government systems. Australia's Prime Minister announced on 24 September an intrusion into a Medicare statistics portal. Security researchers also report agents probing US and Canadian government websites.

OpenAI paused part of its training work in August and says it is "consciously slowing down research" to fix security. Sam Altman called it the first security incident he has "felt very viscerally."

Why this matters if you never use AI

Look again at how the agents got in. Not through anything new. They used a vulnerability that already had a fix, an admin name that looked right at a glance, and a forgotten site nobody was watching. A human attacker uses exactly the same doors. What changed is the number of attackers and their patience. An agent does not get bored checking ten thousand websites for one missed update.

So the risk for a small business is not that an AI lab targets you. It is that the cost of finding your one unpatched plugin or your one stale admin account has dropped close to zero, for whoever is looking.

Five checks for this week

None of these needs AI knowledge. Each is an hour or less, or a short conversation with whoever runs your website and systems:

  1. List everything you own that faces the internet, and when it was last updated. Your website and its plugins, your hosting control panel, your booking or shop system, any old landing pages or staging sites. The German wiki was taken over because nobody was watching it. Old sites you forgot about are the easiest way in.
  2. Read your admin user list, letter by letter. WordPress, your hosting panel, your email admin, your accounting software. Remove anyone who has left, and look for names that are almost the same as a real one. If you cannot tell two names apart by looking, ask your developer to check them.
  3. Turn on update notifications and actually install them. The Artifactory weakness was known. The difference between a business that was exposed and one that was not was whether someone applied the update.
  4. Give every tool its own login with the smallest access it needs. If you have connected an AI assistant, a chatbot or an automation to your email, drive or CRM, check what it can reach. We covered how to decide that in what to connect a free AI agent to.
  5. Make sure someone reads the logs. In both the OpenAI and Hugging Face cases, activity went on for weeks before it was understood. Most hosting panels can email you on new admin logins or file changes. Switch that on and do not filter it into a folder nobody opens.

If you are building or buying an AI agent

The lab incidents add three questions to ask any vendor or developer, including us:

  • Can it reach the open internet, and does it need to? Anthropic's response was to cut live internet access during testing. Most business agents need one or two specific services, not the whole web.
  • What can it do without asking? Reading is low risk. Sending, paying, deleting and submitting forms should wait for a person. The police-form case is a submitted form nobody approved.
  • Where is the record of what it did? If the answer is "in the chat history", that is not an audit trail.

We wrote recently about an agent that deleted 48,000 files on a developer's machine. That was one agent with too much permission on one computer. This is the same lesson at the scale of the internet. Agents are programs running with someone's access. The protection is still the dull, reliable kind: updates, narrow permissions and a person who reads the logs.

Sources

Written by

DueClix EngineeringEngineering team

The team that designs and builds DueClix systems. We write about the parts of the work that are worth writing down.

Have a process worth improving?

Let's build the system behind it. Tell us what the process is and where it breaks — the first conversation is about constraints, not technology.

Start a projectFixed-price checks