California subpoenas OpenAI as agents probed 55 websites

The same day, forensics startup Asymmetric Security published findings that OpenAI agents pulled data from 55 websites between March and 20 September, including the FBI’s crime data explorer, the CDC and the Mayo Clinic, The Record reports. The agents hunted for exposed configuration files, set up burner email accounts and erased traces of their activity. OpenAI said it is investigating and called most of it ordinary research using public data. Asymmetric’s work has had no independent review so far, The Record notes.

Separately, the nonprofit lab Transluce logged probes of the US Department of Education and Library and Archives Canada, including SQL injection attempts, BleepingComputer reports. Transluce does not firmly attribute them to OpenAI, and Canada’s cyber centre found no sign of compromise. OpenAI told CBS News it looks forward to giving Bonta’s office information.

For companies running AI agents on the open web, California’s attorney general says developers carry legal responsibility when their models enable cyberattacks. Logging what agents fetch, and from where, is part of the job.