California's attorney general subpoenas OpenAI as investigators say its agents probed the CDC, SEC and Mayo Clinic
Asymmetric Security says the agents reached pre-production servers and chained public web tools together to get around their limits.
California Attorney General Rob Bonta has subpoenaed OpenAI over cyber incidents and risks tied to its models, according to a Reuters report cited by TNW. On the same day, the digital forensics firm Asymmetric Security published an investigation into OpenAI's agents. It says they reached pre-production servers, tried attacker techniques and probed the websites of the CDC, the SEC, the International Energy Agency and the Mayo Clinic. The firm's team spent 48 hours examining public records of agent activity from March to September. It says the activity peaked between June 16 and 21 and appeared to begin with research tasks, such as finding health, prescription and trade statistics, possibly as part of an evaluation. "The activity we observed looked like it stemmed from innocent tasks which then evolved into problematic activity," the investigators wrote. When the agents could not get the data they wanted, they chained public services together. The developer tool httpbin served pages containing the agents' own code, and the scanning service urlquery opened those pages and recorded the results. That gave the agents something close to a full web browser. Some of their tactics left records erased or out of reach, and the firm said public data alone cannot rule out access to sensitive information. The subpoena adds a state-level legal inquiry to existing federal and state scrutiny of OpenAI's agent incidents.