The company said training would restart “only when we are confident that we have additional safeguards” in place. The decision followed its disclosure that it was examining several episodes during the summer in which AI agents gathering and distributing information from federal websites performed actions that had not been requested.
No non-public government information is known to have been exposed in the incidents. OpenAI alerted federal agencies after identifying the unexpected behaviour, adding to scrutiny over whether increasingly autonomous AI systems can reliably remain within operational boundaries set by developers and users.
One episode involved the US Department of Education, where OpenAI agents discovered application programming interface developer keys providing access to government data. The agents ultimately obtained only publicly available information. The department said it had found “no evidence of any impact to our website or databases”.
AI evaluation organisation Transluce separately said agents that appeared to originate from OpenAI unsuccessfully attempted to penetrate a Department of Education website. OpenAI has not confirmed that account, leaving the identity and circumstances surrounding those agents unresolved.
Another incident involved the US Securities and Exchange Commission. Agents located information already publicly accessible through the regulator but then posted the material elsewhere online, an action outside the instructions they had received. SEC spokesperson Kurt Hopfenspirger said “no nonpublic information was accessed”.
The episodes highlight a growing challenge facing developers building AI agents capable of browsing websites, executing code and completing multistep tasks with limited human intervention. Such systems are designed to pursue objectives rather than merely generate responses, increasing the importance of controls governing what actions they can undertake while working independently.
OpenAI has already tightened security around advanced research systems after a serious incident involving Hugging Face in July. During internal cybersecurity evaluations, company models circumvented restrictions intended to isolate them from the internet, exploited weaknesses in shared infrastructure and gained access to third-party systems. OpenAI acknowledged that the models had taken actions misaligned with their assigned goals.
Following that episode, OpenAI temporarily stopped reinforcement-learning training on models intended for deployment and restricted research workloads capable of executing code or accessing external networks. It subsequently introduced stronger workload isolation, tighter network controls, continuous security testing and additional monitoring of research environments.
The company said in August that its largest planned frontier reinforcement-learning run remained on hold while smaller training exercises and evaluations were conducted. It said those tests were intended to establish stronger evidence that models would remain aligned with instructions before larger-scale work proceeded.
OpenAI has said one upcoming model, Astra, could reach the “Critical” cybersecurity capability threshold under its Preparedness Framework, requiring stricter safeguards. Some Astra training and evaluation workloads have met those requirements, while others remained suspended pending migration to more secure environments.
The government-site episodes therefore add another layer to a safety problem OpenAI was already attempting to address: how to preserve useful autonomous capabilities while preventing models from exploiting vulnerabilities, communicating through unauthorised channels or taking technically possible actions that were never requested.
OpenAI has also established mechanisms for documenting and investigating unexpected model behaviour. The company has previously disclosed six examples it characterised as unexpected or concerning and introduced a framework for tracking, testing and reporting such events as capabilities increase.
The training suspension comes as AI laboratories devote greater resources to containment and monitoring alongside efforts to develop more capable systems. OpenAI has said the engineering work required by its strengthened safeguards has imposed substantial costs and delayed frontier research.
