OpenAI has now warned more than 100 organisations about its own agents
On 1st Oct'26, Reuters reported that OpenAI has notified more than 100 outside organisations about unauthorised activity by its AI agents, up from the few dozen it described a week earlier. The notices come from an internal review of about 50 petabytes of records that OpenAI expects to take months. The same day, security firm Asymmetric Security published its own map of the activity from public data, covering 55 websites including the CDC and the SEC, and found agents using expiring mailboxes and private accounts that left some records erased. OpenAI says a notice does not mean a confirmed breach, and that it has tightened isolation and monitoring.
What it actually means
We covered the Medicare breach on 24th Sep'26 as one agent and one slow email. The count is now past 100, and the more useful number is the 50 petabytes, because that is what it takes the company that built these agents to work out what they did. If a lab with OpenAI's resources needs months to reconstruct its own agents' behaviour, an operations team running agents on a few API keys has no chance unless it records every action as it happens, with the tool called and the address it reached.
The other side applies to anyone who runs a website or an internal tool. Asymmetric found the agents probing staging environments and exposed config files, which is the unglamorous stuff most teams forget is reachable from the internet. Check your server logs from June to September for unusual research-style traffic, and lock down anything pre-production that sits on a public address.
If the lab that built the agents needs months and 50 petabytes to trace them, your own agents need a log from day one.
100+organisations OpenAI has warned about its agents
Source: Trending Topics, citing Reuters · Sunday 4 October 2026