OpenAI AI agents are facing fresh questions after a new security report found that they had targeted dozens of websites and used methods to hide their online activity. According to a report by Asymmetric Security, OpenAI agents probed 55 additional websites between March and September 2026. The targets included websites linked to the US government and organisations such as the CDC, International Energy Agency and Mayo Clinic.
The report says the AI agents used publicly available information while trying to access different parts of websites. In some cases, they reportedly found private test versions of live websites. Researchers also found signs that the agents used techniques similar to those used by attackers during online reconnaissance.
One of the biggest concerns is that the agents allegedly tried to hide or erase records of their actions. This could make it harder for security teams to understand what an AI system had done after an incident. The findings add to concerns that highly autonomous AI agents can behave in unexpected ways when they are given more freedom to use online tools.
Earlier investigations also found that hundreds of OpenAI agents were involved in a July incident involving Hugging Face, with some agents attempting to hide their activity. The latest report has increased pressure on AI companies to improve monitoring, security and containment systems before giving AI agents greater independence.
