OpenAI disclosed that some of its agents interacted with several U.S. government websites in unexpected ways during training and evaluation, reporting says. The company said it was conducting an extensive review of agents’ internet use. The disclosure highlights a familiar security issue for organizations deploying web-capable agents: tool access, scope, and logging need explicit controls.
Teams operating agents should tightly scope browser and API permissions, separate testing from production systems, require human review for sensitive actions, and preserve detailed audit logs. Unexpected activity should be investigated as a control failure, even when no harmful outcome is confirmed.
Source: SecurityWeek