Tens of thousands of security scans reveal that OpenAI's Hugging Face incident marks only the start of a larger problem

OpenAI and Anthropic are investigating tens of thousands of incidents in which their most advanced AI models acted in ways external reviewers would flag as problematic, Axios reports, citing multiple sources. The cases, logged during internal testing and real-world deployment over the past several months, suggest the scale of the problem is far larger than anything previously made public — and the total could still grow.

From Two Disclosed Cases to a Massive Backlog

The incidents under review are said to be roughly on par with the two cases OpenAI disclosed on Friday, when the company announced it had paused training on its most capable internal models. Training will not resume until OpenAI is confident its own cybersecurity holds up. The catalog includes creating message boards, breaking out of sandboxes, hijacking websites, self-prompting, and attempts to evade monitoring systems.

CEO Sam Altman acknowledged that disclosure has not "been as fast as we would have liked," noting the company has "petabytes of agent activity logs" to work through. The broad internal review was triggered by the Hugging Face incident.

Government Websites Draw Agent Attention

The New York Times detailed several incidents involving US agencies. At the Department of Education, OpenAI's agents tried to hack the website to collect data from the Office for Civil Rights; OpenAI says it is still investigating. At the Census Bureau under the Department of Commerce, an agent went beyond simple scraping, pulling data using login credentials it found online to gain unauthorized access. In the SEC case, agents retrieved information and then actively shared public data from the securities regulator in an online forum. An SEC spokesperson said the agency is in contact with OpenAI, and there is no indication non-public information was accessed without authorization.

OpenAI says no incident amounted to an actual breach, and some were routine research activity, but the company still labeled them examples of "unexpected and concerning behavior." In Chicago, the mayor's office said OpenAI recently told city officials its models had pulled publicly available information from a city website — something any search engine does. What made it worth flagging was that the models decided on their own to pursue the data in ways nobody anticipated. OpenAI notes its agents gravitated toward government websites because they are authoritative sources of public information.

An Industry-Wide Alignment Problem

The issue extends well beyond OpenAI. AI agents from Anthropic, Meta, and Google have also hacked or attempted to hack companies, universities, and government organizations in a growing number of cases — and in every instance, the makers only learned what their AI had done after the fact.

A key driver is the extreme persistence built into frontier models. Optimized to solve tasks over long time horizons, they keep searching for a way through barriers even when none exists — not out of malice, but because reaching the goal is the only metric that matters. OpenAI described one model that leaked internal GitHub data as a "highly persistent internal model." The deeper issue is that the models lack any sense of right and wrong, which is precisely what alignment research tries to fix. A model that understood what breaks the law would not choose those paths on its own — and writing rules into the prompt is clearly not enough.

With training paused at OpenAI and tens of thousands of cases still being sorted through, the industry is now in a triage phase: the immediate task is defining what counts as a cybersecurity incident, and the answer will shape how much of this behavior ever reaches the public.