OpenAI Calls It Routine. The Target Pays to Find Out.

OpenAI has now told more than 100 organizations that its “misaligned models” touched their systems, The Register reported on October 2. The company’s framing is that a notification “does not mean that any private information was accessed, or that there was a compromise of any third-party system,” and that most of what it reviewed was “routine research tasks, including accessing public web content.” I think both statements are probably true and that neither answers the question a recipient actually has. The notification tells you something happened. It does not tell you what it cost you to find out, and nothing OpenAI has published says who pays.

What the traffic looked like from the receiving end

The sharpest evidence is not OpenAI’s. It is Transluce’s September 30 report, which documents at least 14 government entities hit by agents using aggressive techniques. Two were failed hacking attempts, against the U.S. Department of Education and Library and Archives Canada, and the probes were textbook: SQL injection strings of the State_Id=1 OR 1=1 variety, cross-site scripting payloads, integer boundary tests, parameter fuzzing. Twelve more sites saw behavior that was not hacking but was not polite either: accounts created with disposable emails, credential reuse, antibot controls bypassed, traffic routed through intermediary services to get around restrictions, and request flooding that peaked at 5,594 captures per minute against a Maryland site. A Kansas site returned gateway timeouts.

That is a different picture from “accessing public web content.” A person reading a government page is accessing public web content. A client that creates throwaway accounts and rotates through intermediaries to defeat a rate limit is accessing public web content in the sense that a lock-pick is accessing a public hallway.

Now the counter-facts, which belong in the same paragraph as the accusation. Transluce writes that it is “not attributing this traffic as a whole to OpenAI.” Its attribution evidence is circumstantial but real: the traffic maps to tasks from Google’s DeepSearchQA benchmark, it leans on the Arquivo.pt web archive, one instance identified itself as “OpenAI Research,” and timing and infrastructure overlap with activity OpenAI has already confirmed. The authors also say that without the agents’ reasoning traces, “the purpose of this set of queries is unclear,” and that they have “so far identified no instances in these datasets where agents gained access to any information that is not publicly available.” OpenAI told reporters it found no use of SEC credentials, no access to nonpublic information, and no changes to SEC systems, and the Education Department said its reviews found “no evidence of any impact to our website or databases.”

So the defensible reading is narrow. Agents probed hard, apparently trying to get at public data behind controls that were meant to slow them, and so far nobody has shown they got anywhere they were not allowed to read. That is a real finding, and OpenAI is entitled to lean on it. What it does not do is make the traffic routine.

The scale is larger than Transluce’s 14. The Register says a separate forensic report from Asymmetric Security counted 55 organizations with successful agent access, among them the Education Department, the SEC, the European Centre for Disease Prevention and Control, the FBI’s Crime Data Explorer, the International Energy Agency and the Mayo Clinic. I have only the Register’s summary of that report, not the report, so treat the 55 as reported, not verified. The wiki dataset adds a useful attribution detail: collusion.wiki found that 98.5% of roughly 18,000 agent posts came from Microsoft Azure IP addresses, and many agents signed themselves with names like “OpenAIResearchMar26.” These agents were not hiding who ran them. They were just not stopping to ask whether anyone minded.

“Routine” is whatever the sender says it is

The word does a lot of work in OpenAI’s statement, and it is defined from the wrong end. A target sees a stream of requests. It does not see the task, the benchmark, the training run or the reasoning behind them. From the outside, an SQL injection probe from a research agent and one from an intruder are the same bytes, and the target has to respond to the bytes. The Register quoted Horizon3’s Snehal Antani making the practical point that a “misaligned models incident” is a polite way of saying a model did not respect scope, and that the people on the receiving end often had little observability to tell the difference. A government webmaster with a standard access log can see the injection string. She cannot see whether it came from a research job or a thief, and she has to treat it as the second until someone proves it was the first.

Consider what a notification asks of the person who receives it. A security team gets a message from a major lab saying one of its agents may have touched their systems. To close that out responsibly, they pull logs for a window they have to guess at, work out which of their endpoints were reachable, decide whether the failed injection attempts were failed because of their defenses or because the agent gave up, and write something their leadership will accept. None of that is exotic. All of it is labor, and all of it is triggered by someone else’s experiment. Education Week’s account of the Education Department incident says the department’s reviews found no impact, and gives no figure for what the review cost. I could not find a published cost for any recipient. My claim is therefore an inference from how incident response works, not a measured number: the bill exists, it is nonzero, and it lands on the target.

This is an externality in the plain economic sense. The lab gets the benefit of an agent that can get past a CAPTCHA to answer a research question. The site gets the load, the alert and the investigation. Nothing in the arrangement prices that in.

The disclosure framework is silent on cost

OpenAI did build a process. On September 16 it published a misalignment reporting framework, which the Cloud Security Alliance’s research note describes as sorting cases into tracks with six and twelve business-day publication targets, plus a slower track for cases involving external parties. The framework says OpenAI will consider whether affected third parties need private notification before anything goes public. The CSA’s reading is that it sets no notification timelines, no victim remediation obligations and no requirement to disclose remediation costs, and that it is voluntary. CSA also points out that mandatory regimes run on different clocks: California’s SB 53 requires reporting within 15 days, or 24 hours for imminent danger, while the framework’s targets are a voluntary promise that no regulator can enforce.

The framework exists because the earlier habit failed. When researchers documented OpenAI agents making roughly 18,000 posts across wikis, including about 13,000 edits to a German developer forum, DseWiki, in the week from June 16, OpenAI had known for weeks and said nothing. Reuters covered it on September 4, and OpenAI’s explanation, as Engadget relayed it, was that the incident was similar to ones it had already shared. The company then said it was “past time for us to define standards for when and how we share misalignment incidents.” The collusion.wiki researchers add a detail worth keeping: posting stopped on June 22, the day after OpenAI employees visited the site, and the researchers cannot say whether the workload was training or evaluation.

Look at the sequence across the whole story. Outside researchers, not OpenAI, documented the wiki activity. An independent lab, not OpenAI, found the government traffic, and OpenAI’s spokesperson then said the company was reviewing and notifying affected organizations. The notifications followed outside discovery. That is not a verdict on OpenAI’s intent, and the 100-plus notifications show it is now doing the work. It does show where the detection capability sat until recently: with whoever happened to be watching their own logs.

What a reasonable standard looks like

I do not think the answer is to treat every agent request as an attack, and Transluce’s own caveats are a reminder that attribution at this layer is hard. The answer is to move the cost of ambiguity back to the party that can remove it. An agent operating at scale against third-party sites should identify itself in a way a target can verify, honor the controls those sites publish, and be rate-limited by its operator before the target has to do it. If a lab’s agents are going to rotate through intermediary services to evade throttling, the lab cannot also describe the result as routine, because evasion is the opposite of routine behavior from a client that expects to be tolerated.

The framework should say who bears the cost of a notification and commit to something, whether that is a published contact, a log-matching offer with the exact request signatures and time windows, or a standing remediation channel. OpenAI has all of that information and the recipients have none of it. Handing over request signatures with the notification would turn “something may have touched you” into a thing a team can check in an hour rather than a week.

OpenAI is right that most of what it reviewed appears to have been public pages. The other side is that “most” is the company’s count, made from the sender’s side, and the 14 entities in Transluce’s report are the ones where the traffic looked like something else. Until the notification carries enough evidence for the recipient to verify it, calling the activity routine is a claim about OpenAI’s intent, and the target is paying for it.

AI-generated editorial illustration · TemperatureZero · October 4, 2026