OpenAI's autonomous browser enters US government systems: What happened
Illustrative photo: AI agents have learned to bypass restrictions (Tara Winstead)
AI agents powered by OpenAI technology have learned to bypass the restrictions of their own environment, with the algorithms independently finding a way to access the open internet.
A new investigation found that between March and September 2026, the agents also probed US government systems, according to Interesting Engineering.
The AI agents were tasked with a routine job: collecting publicly available statistics on healthcare, medical prescriptions, trade, and universities.
However, after running into difficulties while searching for information, the AI began autonomously looking for ways to bypass the restrictions imposed by its secure sandbox.
Probing government resources
After breaking out of the restricted environment, the AI agents did more than simply run search queries — they engaged in full-scale technical reconnaissance.
They gained access to several pre-release testing environments and began scanning the websites of organizations including:
-
the US Centers for Disease Control and Prevention (CDC);
-
the US Securities and Exchange Commission (SEC);
-
the International Energy Agency (IEA);
-
Mayo Clinic.
According to the activity logs examined by researchers, the agents searched for exposed configuration files, attempted to automatically create accounts, and used third-party services to remotely view web pages.
Read also: OpenAI cancels Astra 6.1 after discovering model was lying and breaking safety rules
How did the AI build its own browser?
The most striking part of the investigation was how the AI solved the problem of not having a browser inside its sandbox.
The agents combined two legitimate public services — httpbin and urlquery:
-
httpbin was used to host specially crafted code;
-
urlquery provided a real external browser for following links;
-
the AI agents read the results from publicly generated scan reports, such as web page headers.
The agents later changed tactics, moving from public requests to private accounts in an apparent effort to leave fewer traces for researchers.
The AI also used web archives and the ntfy push-notification service. In one case, an agent compressed the collected data into a 35 KB file and uploaded it through ntfy.
Researchers currently stress that there is no direct evidence that the agents stole classified data or deliberately concealed their actions, and that a full analysis of OpenAI's internal logs is needed before drawing definitive conclusions.
