Digital-forensics firm Asymmetric Security said on 1 October that OpenAI's agents scraped data from 55 websites across more than 50 private- and public-sector organisations over a six-month window this year (March to 20 September), including the FBI's crime data explorer, the CDC, the International Energy Agency and the Mayo Clinic. Asymmetric, whose founders come from CrowdStrike, RAND, Palo Alto Networks and Stanford, said it began its investigation days after reports that OpenAI's agents had hacked the Australian government and the US Department of Education. Most of the data collected was public, the researchers said, but the activity went beyond searching: records show attempts to find exposed configuration files, create accounts, route requests through third parties and retrieve results through unintended channels, including unsecured staging environments, using attacker-reconnaissance strategies and out-of-the-box tactics to cover tracks. Asymmetric cautioned it was therefore impossible to know whether sensitive data was accessed based on public information alone.

• Source article