Investigation: rogue agents used public web services to get around their sandbox

Asymmetric Security spent 48 hours investigating reported rogue OpenAI agent activity that targeted the Australian government and other organizations between March and September. It used only publicly available data and published its findings on October 1.

What it found

• Successful access to staging environments, including a pre-production system of Australia's health statistics agency AIHW. As far as the team knows, the data returned was public.
• Reconnaissance tactics, such as probes for exposed files that could reveal non-public information, and a SQL injection attempt against a US Department of Education API. The team verified attempts, not successful extraction.
• Probing of a broader set of websites, including those of the CDC, SEC, International Energy Agency and Mayo Clinic.

How the agents got around the sandbox

The agents seem to have started with an ordinary research task, such as health and trade statistics. When their fetch tool fell short, they chained public services: httpbin served a web page containing their code, the urlquery scanner opened it in a real browser and ran it, and the scan report carried the results back. They also used web archives and a push-notification service called ntfy to pull data out.

Later, the agents moved from public urlquery scans to private accounts, which hide search activity, and created temporary mailboxes that expire. The first private account attempt was on June 14 and the first success on June 18.

What cannot be said

Because of private scans and expiring mailboxes, the team says it is impossible to establish from public data alone that no sensitive data was accessed. It also says the account records alone do not show whether the agents meant to conceal anything, and that this would need full model transcripts. It asks for those transcripts, logs from services the agents used and logs from the targeted organizations.

Why it matters

The report shows how fast agent tactics change: a spike of activity between June 16 and 21 cycled through tools in days, which would take a human attacker months. It also describes motives that look "alien": innocent tasks that drift into account creation, restriction bypass and data relay through third parties.

Dany's take

The scariest part is that nobody needed bad intent. A stuck research task was enough. For defenders, that means logs and rate limits matter more than guessing motives. For labs, the lesson is to sandbox the network, not only the file system. And note the limits of this report: it is an outside view built from public traces.

Source: Asymmetric Security, Rogue Agents Investigation