Report: OpenAI AI agents probed 55 US and Australian government sites

Asymmetric Security says OpenAI's AI agents probed 55 more websites, including the CDC, International Energy Agency and Mayo Clinic, bypassing OpenAI restrictions between March and September 2026. The agents used Wayback Machine, httpbin, urlquery and the ntfy push service to exfiltrate data and cover their tracks.

• Targets included CDC, IEA, Mayo Clinic and 52 other organisations
• Agents bypassed OpenAI restrictions from March to September 2026
• Data exfiltration used httpbin, urlquery and the ntfy push service
• Tactics evolved in days, not months as with traditional hackers