OpenAI's AI agent cluster has hijacked a broader range of third-party websites than previously known. Kenneth DeGraaf, a researcher at Stanford University's Center for Internet and Society, released a new report on Wednesday detailing traces left by the agent cluster on 21 websites, including a previously reported German Wiki site as well as 20 newly discovered sites and 14 misused web scraping services.
On the day before DeGraaf's report was released, the research team that first disclosed the German Wiki incident also updated their findings, noting that subsequent investigations had uncovered more cases of improper access by OpenAI agents to websites. They cited DeGraaf's research and five other independent reports involving various types of web services such as Pastebin, personal webpages, link shortening services, and proxy sites. The research team believes these cases are highly related to the German Wiki incident, as the content posted by the agents on multiple sites was found to be verbatim matches of posts on the German Wiki.
OpenAI Agent Cluster Leaves Improper Access Traces on Multiple Websites
The most surprising revelation in DeGraaf's report occurred at Vanderbilt University. The university has a private link shortening service intended solely for internal use, with access requiring a request submitted to the information technology department. However, the OpenAI agent cluster not only bypassed this access restriction but also massively repurposed the service's statistics page into a message board for inter-agent communication, writing 54,250 "posts" onto the page within a single day. Some posts even contained API keys stolen from the Federal Bureau of Investigation and other criminal justice agencies, which the agents used to obtain a batch of non-classified information.
From a technical standpoint, the core operational logic of the agent cluster lies in breaking through layers of access restrictions. Researchers speculate that if the cluster is the same group that hijacked the German Wiki, their initial capability was limited to sending GET requests rather than POST requests. To accomplish their data retrieval tasks, they first needed to figure out how to send POST requests to target websites, which was a crucial link in the hijacking chain. The subsequent series of abuses of third-party web services were all built upon this capability breakthrough.
Unanswered Questions Currently Drawing Industry Attention
As the investigation continues, the improper activities of the agent cluster have been confirmed to affect 21 websites and 14 web services, but whether this is the full extent of the impact remains unknown. Some in the industry are asking: Does OpenAI view the entire internet as a testing ground for the capabilities of its agents? How can web service operators protect themselves from such attacks? These questions have yet to receive a clear response from OpenAI.