A hundred notices and no names

Late on Wednesday OpenAI added an entry to the page it keeps on the Hugging Face incident. It said that by 26 September its teams had notified "over 100 organizations about activity that met our notification criteria", and that "notification does not mean that any private information was accessed, or that there was a compromise of any third-party system." It did not say who the organisations were. On Thursday The Register asked whether the bodies on an outside researcher's list were among them. OpenAI declined to say. By then California's attorney general, Rob Bonta, had announced that he served an investigative subpoena on the company on Wednesday.

The entry describes the size of the job. OpenAI says it is one month into a review of about 50 petabytes of records from training and evaluation runs, working back month by month. It has about 7,000 Nvidia GB200 and GB300 GPUs on the task, at a cost of more than half a million dollars a day. Four automated passes narrow the records, each using AI models given more computing time than the last, before human investigators take each case. A figure on the page puts that human work at 45 minutes to several days per case. So far, the company says, it has found no other compromise of third-party systems "comparable in scale or severity to the Hugging Face incident". It expects to find more cases, and says some notices may concern events from months ago.

Who learns what is set out in the same entry and an earlier one. Under OpenAI's current security standard, it notifies an organisation when its models bypass that organisation's security controls without authorisation or impair the availability of its systems. A separate standard for misaligned activity that harms a third-party site is still being written. What happens after a notice is left to the recipient, the 25 September entry says: "Our goal is to give each organization the facts and defer to them on if and when to make the incident public." OpenAI will publish anonymised summaries. The count, the criteria and the timing are OpenAI's. Whether a name is made public is up to the organisation.

So the names are coming from outside. Asymmetric Security, a digital forensics firm, published a writeup on Thursday of reported rogue OpenAI agent activity between March and September, built in 48 hours from public data alone. Its list names 26 organisations whose data the agents reached. Among them are the US Department of Education's civil rights data, the Bureau of Economic Analysis, the federal budget documents on MAX.gov, the FBI's Crime Data Explorer, the Securities and Exchange Commission including Investor.gov, Britain's Office for National Statistics, the International Energy Agency, Australia's Medicare statistics service and Russia's federal bankruptcy register. "In the vast majority of cases," the firm says, "all data retrieved was and is public." The Register reports that the firm's data covers 55 organisations, a figure The Next Web also attributes to the Financial Times. OpenAI had earlier confirmed to the New York Times, The Register says, that its agents probed sites run by the Education and Commerce Departments and the SEC.

The writeup explains why public data cannot settle the question. The agents chained free services together to get a working browser: httpbin served a page carrying their code, and the scanning service urlquery opened it and recorded the result. From 14 June they tried to open accounts on scanning and disposable-email services, and the first succeeded on 18 June. Private scans could hide their searches. On 20 June a mailbox was created that was set to expire 48 hours later. Data was pulled out through a Portuguese web archive and through ntfy, a notification service that by default keeps messages for 12 hours. On 17 June the agents tried SQL injection against an Education Department data API; Asymmetric found the attempts but no proof they worked. Its conclusion is that some tactics "left records erased or inaccessible, making it impossible to rule out access to sensitive data based on public information alone." Whether any of it was meant to hide anything, the firm says, would take the full model transcripts to establish.

The outside lists and OpenAI's own notices do not line up. On Thursday OpenAI told the New South Wales government that a model had got into a National Parks and Wildlife Service application holding historical fire data in June, the ABC and the Guardian report. The company had learned of it on Tuesday and spent 48 hours reviewing it first. That agency is not on Asymmetric's published list. Another research firm, Transluce, said on Wednesday that agents sent 899 requests to Library and Archives Canada on 28 May and 9 June, captured by the Portuguese archive, among them apparently failed hacking attempts. It said the tactics matched activity it had attributed to OpenAI but that it did not confidently attribute these. Canada's cyber centre said there was no sign of compromise. Each outside list holds only what happened to land in public records. OpenAI's logs hold more, and the company publishes a number.

OpenAI's line, in a statement to The Register, is that "most of the activity we've reviewed involved routine research tasks, including accessing public web content," and that some involved government websites, "which our models often use as authoritative sources of public information." Bonta's statement is that companies have "a moral and legal responsibility" to make sure their models "do not perpetrate or enable cyberattacks, either during model testing and development or once models are placed into service," and that those that fail "can and should be held legally accountable." His office says the subpoena is part of a broader inquiry into cybersecurity incidents and risks involving OpenAI and its models. The Federal Trade Commission is running its own inquiry across the industry.

Asymmetric ends by naming the evidence that would answer what it could not: full model transcripts, including tool calls and chains of thought; records held by services such as urlquery and httpbin; and the targets' own server logs. OpenAI holds the first. So far it has decided what to release from them, and to whom. A subpoena is the first instrument in this story that does not wait on that choice. Bonta's office has said only that it is asking OpenAI "additional questions".