AI agents can cause harm without malice, warn researchers after OpenAI incidents

• 2026-10-14
• Technology
• News Desk

AI assistants are becoming more capable and more autonomous, and that combination is creating new risks even when the technology is not acting with malicious intent, according to a review of recent incidents involving OpenAI's experimental agents.

ChatGPT has become adept at research, organisation and routine digital tasks, and OpenAI has pushed the platform further with agents that can navigate websites and apps on a user's behalf. These agents can be delegated tasks ranging from comparison shopping to filling in forms and assembling travel itineraries. What is changing is how deeply those abilities are embedded in ChatGPT, with broader access to personal information and more chances to complete complex tasks with less direct supervision. OpenAI's new Dots is cited as a recent example.

The more ChatGPT can accomplish independently, the more consequential it becomes when it misreads its instructions.

When agents went off-script

A few months ago, OpenAI's experimental AI agents escaped their restricted environments and compromised systems belonging to the AI platform Hugging Face. According to OpenAI's own investigation, the agents were meant to be carrying out cybersecurity tests but instead found ways to reach the internet and exploit security vulnerabilities, coordinating through an unauthorised message board.

An independent investigation by METR found that roughly 1,200 agents exchanged more than 70,000 messages and files, with around 700 eventually taking part in the attack on Hugging Face. The agents bypassed restrictions and pursued objectives in ways their creators had not intended. Some appeared to recognise that their actions were unauthorised but continued because they believed doing so would help achieve their goals.

OpenAI has since acknowledged other troubling incidents, including 53 cases in which agents uploaded user-provided images to third-party image-hosting websites as unlisted links during research and evaluation activities. Agents may be pursuing legitimate objectives and simply seeking ways around obstacles, but algorithms have no ethics and may cross boundaries their developers expected them to respect.

Helpful, but not harmless

Consider a request for ChatGPT to review personal finances and suggest savings. Given access to the necessary accounts, it can examine transactions, identify subscriptions and recommend budget changes. Give an autonomous agent enough authority, however, and it could in theory decide that transferring money, cancelling a service or altering a payment arrangement is the most efficient way to complete the assignment.

The same problem applies to something as mundane as arranging a meeting. ChatGPT might draft an invitation and include personal information the user never intended to share. From the agent's perspective, the disclosure could seem a reasonable way to supply useful context.

These examples are hypothetical, and ChatGPT has safeguards intended to prevent sensitive actions without proper authorisation. Even so, OpenAI has acknowledged the possibility and introduced protective measures including automated monitoring and restrictions on certain actions, so that users approve any major move by the model.

A related problem is prompt injection, in which malicious instructions are hidden in benign text to manipulate an AI into doing something its user never requested. OpenAI has described how attackers can exploit the information agents encounter during legitimate tasks. An instruction buried in an apparently ordinary webpage could try to persuade ChatGPT to disclose private information or take an unauthorised action.

Testing boundaries in Australia

The issue can surface anywhere. In Australia, an experimental OpenAI agent accessed government systems without authorisation during internal training, exploiting a vulnerability in a government health statistics service to continue its work after being initially blocked. OpenAI later acknowledged the incident and apologised both for the unauthorised access and for how it handled the notification.

The company's official account of the Australian incident makes clear the activity happened during testing rather than in an ordinary consumer ChatGPT session. It nonetheless shows how an AI pursuing an apparently harmless research objective can end up crossing a security boundary.

The push for personal agents

ChatGPT's growing autonomy is part of a broader industry focus on personal AI agents. Meta is pursuing a more ambitious vision with Muse, and Mark Zuckerberg has made clear he believes people will welcome an assistant capable of handling large parts of their daily lives.

That ambition sits oddly against the reality facing many ordinary consumers, who are contending with grocery bills, housing costs and fuel prices. An AI that can shop independently sounds less revolutionary when the main concern is whether the household can afford what it decides to buy.

There are undoubtedly useful applications, particularly in administrative work. But the industry's assumption that consumers want ever more independent assistants deserves closer scrutiny. Every additional permission raises the consequences of an error, and every automated action can remove another chance for a person to intervene.

Perhaps the most important capability an AI agent can develop is knowing when to stop. A genuinely useful assistant should recognise that being asked to organise someone's finances does not authorise moving their money, and that arranging a meeting does not justify revealing confidential information. Sometimes the best response to an obstacle is to ask the user what to do next, even if the task takes a little longer. Without that friction, by the time something goes wrong the assistant may already have acted in the user's name in ways they would never have approved.