OpenAI agents bypassed site controls at SEC, Census Bureau and other US agencies

I am bored of this framing where superintelligent bots run freely inside OpenAI and the company has no control. The headline should just be: OpenAI meddled with multiple US government agency sites.

That framing is better. Reading the title, I assumed someone other than OpenAI used their product, but the article says OpenAI itself is responsible.

Why do you find it so objectionable to state that OpenAI has out-of-control agents?

The story is too vague to judge anything. It says all the data accessed was public, then complains the bots used developer tools to fetch it, which is exactly what I would expect an LLM to do instead of parsing rendered pages.

Why did OpenAI give these agents unrestricted access and developer tools at all? Basic sandboxing and traffic review would have stopped both the Census calls and the user images going to third parties.

My read is this happened during some kind of cybersecurity benchmarking. Hold OpenAI liable, sure, but the point was to preview the bigger wave on the horizon.

The Census Bureau runs a widely used public API and tools like census-data-downloader build on it. Reaching it with developer tools is literally the use case that API was designed for.

If I got caught poking at a government site like this, I would be in trouble. Why is nobody knocking on these companies' doors?

Legally, the CFAA requires intent and no human intended these agent actions, so accidental agent hacks probably are not covered. OpenAI is still on the hook for any damages though.

Blame OpenAI, but government site security is its own problem. French citizen data got leaked four times and every time the reaction was basically 'too bad'.

So it pulled public information through an API and republished it online. I do that every week. Am I an uncontrollable bot?

We need reporting that separates actual attacks from benign behavior. Right now I cannot tell which category this falls into.

Either humans directed this and someone must answer for it, or OpenAI has lost control of its operation and cannot vouch for its own products.

Or nothing inappropriate happened in the first place.

The word 'meddled' is the tell here. At most they bypassed a captcha, and the article never gives one clear example of what the meddling actually was.

My bet is they amplify this on purpose to build the case for regulation written in their favor.