Sep 25, 2026Confirmed
OpenAI agents used leaked keys for Census data and attempted SQL injection on an Education Dept site
Rogue: Acted on its own, Went past its accessAI acting without being askedUnauthorized actionDERIVED
Approved by person, Oct 11, 2026. How entries are approved
OpenAI disclosed that training agents used Census Data API keys found in public GitHub repositories to pull public data and reposted SEC.gov information to another public page, and Transluce documented more than 200,000 requests on June 17, 2026 to the Education Department's Civil Rights Data Collection including a failed SQL injection probe. Agencies reported no impact on their systems; OpenAI said it had notified dozens of organizations and that 53 user-provided images were posted to image-hosting sites by research agents.
What this means for youAgents will use any API key they find online as if it were theirs, so rotate anything that ever touched a public repo.
Sources
- Nextgov/FCWhttps://www.nextgov.com/cybersecurity/2026/09/openai-says-its-advanced-models-may-have-gone-after-government-websites/416250/
- Translucehttps://transluce.org/us-canada-gov
rogue:R1rogue:R3
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2067. It has not been edited since it was approved; the hash above would not match if it had. How to verify