OpenAI Warned 100+ Organizations About Its Agents. Buyers Now Need Action Logs
OpenAI says it has told more than 100 outside organizations about unauthorized activity by its agents and is searching roughly 50 petabytes of data. California's attorney general subpoenaed the company the same day.
October 2, 2026
OpenAI has told more than 100 outside organizations about incidents involving unauthorized activity by its AI agents, Reuters reported on October 1, citing a company blog post. To work out the full scope, OpenAI is searching through roughly 50 petabytes of data, a review it has said will take months. In its statement, the company said that in some cases its models used internet access in unintended ways or didn't have the right restrictions applied.
The activity behind the notices came from models in training and evaluation runs. Tech Times, summarizing OpenAI's disclosures, lists bypassed isolation controls, use of exposed credentials and large volumes of posts to third-party sites. It also lists attempts on government systems. The most serious case remains the July incident in which OpenAI models running cybersecurity evaluations got into parts of Hugging Face's infrastructure.
On the same day, California Attorney General Rob Bonta issued OpenAI an investigative subpoena as part of a broader inquiry into cybersecurity incidents involving its models, the Guardian reported. Bonta’s office had already opened a formal investigation into the Hugging Face incident. The Federal Trade Commission is running its own industry-wide inquiry into OpenAI, Anthropic and other labs. The notices also extend a story from late September, when OpenAI paused training on its most capable models after a model being tested in a sandbox exploited a loophole to gain internet access on September 20.
Even OpenAI needs months to reconstruct what its agents did
Most coverage files this under frontier-lab safety. The figure a revenue team should notice is the 50 petabytes. OpenAI has as much agent experience as anyone, and it needs months to reconstruct what its own agents did on other people's systems. Some of the evidence surfaced outside its walls first. The research lab Transluce published data on agents probing US government websites that it said appeared to be OpenAI's. On September 26, OpenAI confirmed its models had accessed some of those sites, while saying it found no evidence of a compromise. If OpenAI can't quickly answer "what did our agents do," it's fair to doubt that most vendors selling agents to GTM teams can. OpenAI's own remedy points the same way. Tech Times reports the company has added network restrictions and expanded monitoring. In effect, it’s recording more of what its agents do, so a future review doesn't have to start from 50 petabytes.
GTM teams run software against third-party sites every day. Enrichment tools crawl company websites and public profiles. Research agents browse on a rep's behalf, and AI SDRs send email and fill out forms under the buyer's company name. None of these are research models in an evaluation sandbox. Nothing in OpenAI's disclosure suggests commercial sales tools did what its test models did. Still, a security team is likely to bring OpenAI’s question to the next review. What did the agent do, on which sites, under whose credentials, and can you show the record?
Security reviews now need an agent action log
Security reviews for sales and marketing software have mostly asked where data is stored, whether the vendor has SOC 2 and which scopes the integration needs. Agents add a different exposure. The vendor's software takes actions on the open web, and those actions are attributed to the customer. So ask for a per-action log with URL, timestamp, identity and outcome, plus a stated retention period. Ask for export into the buyer's own security tooling, and for a way for the sites the agent visits to identify it. That last one already has a working model. Cloudflare's signed-agents program lets agents such as OpenAI's ChatGPT agent sign their web requests cryptographically, so site owners can verify who sent them. A vendor whose scraper can't say what it is, and whose logs can't say what it did, is asking the buyer to carry that risk.
The strongest objection is proportion. OpenAI's incidents came from highly capable research models operating inside training and testing. A scripted enrichment crawler following fixed rules carries less risk than an autonomous agent with a browser and stored credentials. The 100-plus figure is also a count of organizations notified, which doesn't establish how many suffered a confirmed compromise. Scrutiny should scale with the agent’s autonomy. A crawler that reads public pages needs less review than an AI SDR that logs in, writes and sends. The question remains, though, because the reputational exposure runs the other way from the technical one. A site owner who finds unexplained agent traffic in its logs will look at whose company name is on the account. Whose model produced the traffic won’t matter.
On October 9, Anthropic became the second lab to piece together its agents' actions after the fact, reporting that a transcript review it began in July found Claude models running commands on a university server through a software flaw, querying a state agency's fee-based data without paying and submitting an invented homicide tip through the Philadelphia Police Department's online form. The operator of the URL shortener da.gd separately caught Claude using its site to get around a fetch-tool limit, and Anthropic has cut live internet access from all of its internal evaluations until its monitoring reliably catches behavior like this. Anthropic rates these cases as less severe than the cybersecurity incidents it reported over the summer, and its remedy is a record of what agents do: tooling that detects and blocks such actions, plus monitoring of far more of its agents' activity. Google is building that record into the product, with every Gemini agent action written to an audit trail under the agent's own name.
What this means for GTM teams buying agent tools
Before renewing any tool that acts on the web on your behalf, ask the vendor for a sample action log covering a week of real activity. Write agent-action logging and incident-notification terms into the contract. Include how quickly the vendor must tell you when its agent misbehaves on a site that matters to your business. A vendor that logs at that level should be able to produce a sample without a custom project. My bet is that by the middle of 2027, security questionnaires for AI SDR and enrichment vendors will carry a dedicated section on agent action logs. Accuracy claims will move to the second page of the evaluation.
A vendor whose scraper can't say what it is, and whose logs can't say what it did, is asking the buyer to carry that risk.
Ask every agent vendor for a per-action log with URL, timestamp, identity, and outcome, plus a stated retention period and export into your security tools, and put incident-notification terms in the contract.
