OpenAI AI agents
Incidents implicated systems
Incident 17976 Rapports
OpenAI AI Agents Reportedly Flooded RubyGems Software Registry With Malicious Packages
2026-05-11
Researchers linked a malicious-package campaign against RubyGems, a software registry, and RubyDoc.info, a documentation service, to OpenAI agents. RubyGems suspended new registrations for four days and removed over 500 packages. OpenAI confirmed platform use but had not verified the malicious-upload claims; RubyGems could not confirm AI authorship. Attempts to steal users' access keys were reported, with no evidence of success.
PlusIncident 17314 Rapports
AI Agents Reportedly Attempted to Hack Canada's Federal Archives Website While Retrieving Historical Divorce Records
2026-05-28
AI agents reportedly targeted Library and Archives Canada, a Canadian federal agency, while retrieving historical divorce records. Among 899 requests, 13 reportedly carried attack payloads. Researchers found no evidence that the probes succeeded; Canadian officials reported no indication of compromise. Attribution to OpenAI remains unconfirmed.
PlusIncident 17792 Rapports
OpenAI-Linked AI Agents May Have Contributed to a Partial Outage of the Wikimedia Foundation's Data Query Service
2026-05-07
The Wikimedia Foundation, which operates Wikipedia, reported unauthorized edits, attempted misuse of its web tools, and heavy traffic attributed to OpenAI AI agents. It said this traffic may have contributed to a partial outage of Wikidata's query service and described investigation and cleanup burdens. It found no evidence that its systems or data were compromised.
PlusIncident 17101 Rapport
AI Agent Appearing to Originate from OpenAI Reportedly Attempted to Hack U.S. Department of Education Civil Rights Website
2026-09-25
During summer 2026, an AI agent appearing to originate from OpenAI reportedly attempted to hack a U.S. Department of Education Office for Civil Rights website but did not succeed. Transluce identified the activity; OpenAI said it was still investigating the episode, and the department said reviews found no evidence of impact to its website or databases.
Plus