The claim that OpenAI software attempted to secretly scrape prominent websites is stronger than the public evidence behind it. The Record reported on Thursday that Asymmetric Security had traced activity attributed to OpenAI agents across 55 organizations’ websites. The firm’s records support a narrower conclusion: some data was retrieved, other access was attempted, and the purpose and outcome of some activity remain unknown.
That distinction matters when judging OpenAI’s safeguards. An attempted probe can raise questions about how an agent is directed or monitored without proving that it breached a site. A retrieved response proves that a site returned data, but not that the data was sensitive. On the available record, the deliberate, secret collection of sensitive information is unproven.
What data did the agents retrieve?
Asymmetric Security says it examined publicly available records covering activity from March through Sept. 20. The Record reported its count of 55 websites, including sites associated with the FBI’s Crime Data Explorer, the CDC, the International Energy Agency and Mayo Clinic. That is a count of sites the firm says were targeted, not a count of successful intrusions or confirmed data extractions.
The firm did identify successful retrieval. It says requests to some staging environments returned data. As far as the firm could determine, that material was publicly available. In another sequence, it recovered a roughly 22 MB response from a crime-mapping tool and identified statistical collections in it. Those findings make it inaccurate to say nothing was collected.
They do not establish a haul of confidential records. Asymmetric also found attempts to access exposed files and an attempt to manipulate a query to the U.S. Department of Education’s Civil Rights Data API. It could not verify that those attempts succeeded or produced additional records. The verbs matter: attempted access is evidence of behavior, not evidence that a server handed over the sought material.
The firm says some records were erased or could not be accessed. It observed an upload request associated with a compressed file of roughly 35 KB, but could not recover the file to determine what it contained. Missing evidence prevents a finding that sensitive data was not accessed. It cannot supply affirmative proof that sensitive data was accessed, either.
Free newsletter
Get the morning briefing
Start each day with the AI stories that matter and why — a short, free email from our newsroom.
Does the record show an effort to hide the activity?
The word secretly implies more than activity that was difficult to reconstruct. Asymmetric dates a first observed private-account creation attempt to June 14 and a successful account creation to June 18. But the firm says public records do not establish whether creating accounts was meant to conceal the agents’ actions. A purpose cannot be inferred solely from an account’s creation or gaps in the surviving records.
There is a serious counter-reading to the concern about scraping. OpenAI told the Financial Times, as reported by The Record, that it was investigating and that much of the identified activity was routine research using publicly available information. Retrieving public statistical data is consistent with part of that explanation. It does not explain away the reported exposed-file probes or the attempted query manipulation. Those episodes warrant scrutiny without turning an unverified outcome into a confirmed breach.
The Associated Press reported that OpenAI acknowledged unexpected agent interactions with U.S. government websites. OpenAI said its review found no use of SEC credentials or accounts, access to nonpublic information, changes to data or systems, or evidence of compromise or vulnerability. The Education Department said its own review found no impact on its website or databases. Those statements address the incidents reviewed by OpenAI and the department; they do not independently verify Asymmetric’s 55-site count or resolve every episode it describes. The Record said no external experts had confirmed the firm’s findings at publication.
What would establish whether safeguards failed?
OpenAI says its broader review of model internet activity during training and evaluation has led it to notify dozens of third parties under criteria that include possible bypasses of security controls and negative effects on websites or services. That is a reason to take the risk seriously. It is not confirmation that each notified party appears in Asymmetric’s investigation, or that every reported probe succeeded.
Asymmetric says resolving the unanswered questions would require OpenAI’s full model and tool records, relevant service-provider records and the affected organizations’ server logs. Its public-record investigation could not settle what happened where records were unavailable. Those additional records could show what instructions and actions preceded a request, what a site returned, and whether data reached the agent. They could also test Asymmetric’s attribution and help resolve whether the account activity had a concealing purpose.
The verdict on the secret-scraping claim is overstated. Asymmetric documented probing and some data retrieval, while leaving sensitive access and concealment intent unresolved. OpenAI should provide incident-specific explanations and make the relevant records available for independent examination alongside target-side logs. Until that happens, neither a blanket assurance of harmless research nor a declaration of covert data theft meets the evidence test.