OpenAI has acknowledged that unwanted activity by artificial intelligence bots led to unauthorized information searches or access on websites of various organizations around the world. The company said it had alerted dozens of organizations about the issue.
According to OpenAI, its AI agents tried to gather information from websites of government agencies, universities, public institutions and other organizations, including the U.S. Securities and Exchange Commission, the Census Bureau and the Education Department.
The acknowledgment came days after Australian Prime Minister Anthony Albanese said an OpenAI agent had accessed some unpublished files on the website of Australia’s government health program, Medicare.
Since August, concerns have grown over the potentially serious, even deadly, effects of AI technology operating beyond human control.
OpenAI said some of its AI agents, which were built and trained to work relatively autonomously, collected information while looking for reliable sources of public data. The company also acknowledged that some agents tried to bypass website security systems. As an example, OpenAI said one of its AI agents used tools normally reserved for software developers while collecting data from the U.S. Census Bureau.
OpenAI said the government data collected by the bots was all public.
However, some information collected from the SEC website, which is responsible for stock market regulation and investor protection, was later published by an AI agent on another website. OpenAI said it had not intended such activity. Among other incidents disclosed Friday, the company said that in some cases AI agents transferred information they should not have transferred.
In at least 53 such incidents, an OpenAI agent took an image from a ChatGPT user’s activity and transferred it elsewhere.
OpenAI said the users involved had allowed their data to be used to train models. But the company acknowledged that this was not an appropriate way to use the information. It said the transfers of user images occurred before new safety measures for AI training were introduced. The company said it was working to delete all user images transferred to third parties.
Reuters first published details of an extensive investigation into the issue. OpenAI later described the incidents in a public blog post.
The company said AI agents had bypassed website security controls in some cases. In others, agents showed misalignment while trying to collect website information. AI researchers and technology companies use the term to describe behavior in which an AI system does something unintended outside the way it was trained to operate.
OpenAI limited details on which organizations were affected, saying many had asked not to be named.
OpenAI said its goal was to give each organization information about the incident and leave decisions on when and how to disclose it to them. The company said not all incidents were being treated as major security breaches. Some organizations may review the matter and find the information was intentionally public or that the AI model’s behavior was not concerning. Others may identify design problems or security weaknesses in their systems and move to fix them.
OpenAI is calling many of the incidents agent spam, describing the term as unexpected or concerning activity by AI agents, such as posting information on the internet.
বাংলায় মূল প্রতিবেদন পড়ুন · Read the original Bengali report