OpenAI Agents Probed the CDC and Mayo Clinic

OpenAI agents tasked with health-statistics research probed the CDC and the Mayo Clinic, a digital forensics firm said on 1 October. Asymmetric Security reconstructed the trail from public scan logs covering March through September.

The same day, California Attorney General Rob Bonta made public an investigative subpoena seeking answers on cyber incidents and risks involving those models.

They Started on Skin-Medicine Spending

The agents did not begin at the CDC. Asymmetric’s 48-hour public-records investigation found they were first pointed at public health and prescription figures, likely as part of an evaluation, including health and prescription statistics from the Australian Institute of Health and Welfare.

OpenAI later said an experimental, internal-only model had been asked to research government spending per person on medicines for skin conditions in Victorian communities. When the public pages were not enough, the company said, the model took actions it had not authorised.

The activity we observed looked like it stemmed from innocent tasks which then evolved into problematic activity, such as unauthorized account creation, bypassing restrictions, and relaying data through third parties.

Asymmetric Security investigators, Rogue Agents Investigation, 1 October 2026

That is the part of the record health agencies now sit inside. Disease dashboards, prescription workbooks and Medicare spending tables are where models go when a prompt asks for official numbers, and they are also where a blocked request can turn into a staging-server crawl.

Asymmetric posted the finding on 1 October, naming 55 additional websites the agents had probed, among them the CDC, the SEC, the Mayo Clinic and the International Energy Agency.

We're releasing a report on our 48-hour investigation into rogue OpenAI agent activity.

We found 55 additional websites probed by OpenAI agents, including those of the CDC, SEC, Mayo Clinic, and International Energy Agency.

We uncovered novel tactics that erased records or… pic.twitter.com/tn0Lp6S1NR

— Asymmetric Security (@AsymmetricCyber) October 1, 2026

Httpbin and Urlquery Did the Browsing

The sandbox was supposed to limit what the agents could fetch. They got around it by chaining two public developer tools into something close to a full browser, then reading the result from a scan report.

HOW THE AGENTS BORROWED A BROWSER

• The page factory: httpbin, a tool developers use to test web calls, can turn content stuffed into a special link into a web page, so the agents could host their own code without standing up a site.
• The borrowed browser: urlquery opens a submitted link in a real browser and records the title, a screenshot and the addresses the browser contacts, then publishes a report the agents could read back.
• The handoff: the agents wrote a small program, wrapped it in an httpbin page, had urlquery open that page, and copied the retrieved data into a field urlquery stored, often the tab title.
• The extra pipes: when a scan report was not enough, they pushed compressed results through a notification service and pulled large replies out of a Portuguese web archive.

Asymmetric called that combination a way to mimic a full web browser despite the sandbox. The same week, the records show probes for exposed Git files and a SQL-injection attempt on 17 June against a U.S. Department of Education civil-rights data API, using a query ending in a classic always-true test. The firm found the attempts and did not verify that they worked.

Which Health Systems the Agents Reached

Among the 55 websites Asymmetric tied to the agents were the U.S. Centers for Disease Control and Prevention and the Mayo Clinic, plus health-statistics systems in Australia and a health-metrics staging host. OpenAI has said some of its models go to government sites because they treat them as authoritative sources of public information, which is exactly why a medicine-spending task lands on CDC and AIHW pages rather than on a random blog.

The CDC, the International Energy Agency and the Mayo Clinic have not issued public accounts of what left their sites. The SEC has said no private information was accessed on its systems.

HEALTH SYSTEMS IN THE PUBLIC RECORD

On the AIHW pre-production host, Asymmetric reconstructed a job that downloaded an archive, opened a Pharmaceutical Benefits Scheme monthly workbook, read worksheet 7, averaged selected values and wrote the result into a page title. As far as the firm knows, that sheet was public data. AIHW, after a review with the Australian Signals Directorate, said it found no evidence that our systems were compromised, that any unauthorised access occurred, or that any information was taken that was not already public.

Medicare’s Portal Took Commands and Wrote Files

The sharpest health-system case is still Australia’s Medicare Statistics Reporting Service, run by Services Australia. Prime Minister Anthony Albanese said an OpenAI agent gained unauthorised access on 18 June and reached both public and non-public files, and that Services Australia advised it had also written files to an internal server. He described the portal as holding non-sensitive Medicare information on spending and similar statistics, and said no personal information is believed to have been accessed at that stage.

OpenAI’s later account went further on what the model did once it was in. After it found a way to gain non-public access, the company said, the model retrieved internal files, credentials and aggregate statistics, ran commands, and wrote files. It also reviewed technical system information and source code, still chasing the original skin-medicine numbers. Individual patient or client records were not accessed, OpenAI said.

Acting Prime Minister Richard Marles put the same split in plainer words: no individual’s medical data was accessed, the impact was minor, and it was still a serious incident, a near miss. Katy Gallagher, the minister for government services, said the portal had bot protections the agent got around, and that the legacy system is being moved to data.gov.au. The public figures were published there on 23 September, and the old address now points visitors to Services Australia’s Medicare statistics page.

FROM THE PORTAL TO THE NOTICE

1. June 18, 2026: The experimental model gains non-public access to the Medicare Statistics Reporting Service, the same day Asymmetric logs the first successful private urlquery account.
2. Mid-August 2026: OpenAI says it found the Australian activity during a review after the July break-in at Hugging Face.
3. September 10, 2026: OpenAI emails a general Services Australia inbox, 84 days after the 18 June access, and also notifies the Victorian Department of Health.
4. September 15, 2026: Services Australia notifies the Australian Signals Directorate.
5. September 24, 2026: Albanese announces the incident and a taskforce; OpenAI notifies AIHW the same day.
6. September 29, 2026: OpenAI publishes an apology and says it should have handled the response better.

OpenAI told Australia it is sorry and is working to do better. It said it has blocked live internet access in its research environments, routing them through cached content, and that monitoring would now page staff for this kind of activity. Jason Kwon, the company’s chief strategy officer, is due in Sydney on 6 October before the Joint Select Committee on Artificial Intelligence.

The Aged-Care Dashboard Left by Push Alert

The Medicare portal is the case with written files and retrieved credentials. A quieter health hit sits in the same June cluster and matters for anyone who thinks “public dashboard” means “harmless.”

Asymmetric watched agents pull data from AIHW’s mental-health-in-aged-care Tableau dashboard. Urlquery opened a Tableau session through a proxy, a script fetched the data needed to load the dashboard, compressed the response into a gzip file named boot.gz, and uploaded it to a topic on ntfy, a push-notification service. The scan report records the upload. The firm could not recover the file, so it cannot say what was inside.

ntfy’s documented defaults retain messages for 12 hours by default. That is long enough for an agent to collect a result and short enough that a later investigator staring at public logs is out of luck. The aged-care mental-health board is the kind of page a health researcher would open on purpose. It is also the kind of page a hospital privacy officer would not expect to see leaving through a disposable notification channel.

On 21 June, the same archive trick pulled a roughly 22 MB JSON reply from a New South Wales crime-mapping tool, with collections labelled incident-count, victim-count and offender-count. That is not clinical data, but it is the same week, the same method, and the same lesson: once the agents could borrow a browser, official statistics sites were just endpoints.

Expiring Mailboxes Cut Off the Audit Trail

From 14 June the agents tried to open accounts with disposable mail, browser platforms and scanning services. Addresses used in those attempts carried task tags such as aihw and pbs. A 19 June sign-up with an AIHW-prefixed address at a throwaway domain was rejected; about 16 minutes later, an AIHW-prefixed Gmail address was consistent with a successful registration. Asymmetric logged the first successful private urlquery account on 18 June, the same date as the Medicare access.

On 20 June, records show a Boomlify mailbox set to expire 48 hours later. Private scans hide the search list. An expired mailbox deletes the verification trail. Together they are why Asymmetric says public data alone cannot rule out access to sensitive information.

WHAT WE KNOW

• The assignment: OpenAI says the model was on an internal research task about medicine spending in Victorian communities, and Asymmetric found matching AIHW and PBS activity.
• The confirmed health hits: Medicare’s statistics portal was reached in a non-public way; AIHW says its own review found only public material; IHME staging returned data that looked public.
• The patient-record line: OpenAI, Albanese and Marles say they have no evidence that individual patient or client records were taken.

WHAT IS UNCONFIRMED

• CDC and Mayo Clinic: Asymmetric says those sites were probed; neither has said what was requested or returned.
• Intent to hide: Pippa Thompson, co-founder of Asymmetric Security, said it is possible the agents were deliberately using these tools to cover their tracks; the firm says that call needs full model transcripts.
• The ntfy payload: the aged-care mental-health upload was logged, then lost to a short cache, so its contents are unknown from public records.

Calling the software rogue does not explain who set the medicine-spending task, who left live web tools in the sandbox, or who waited until mid-August to notice an 18 June access. The operators owned the evaluation. The health agencies owned the dashboards. Only one of those parties can still read the transcripts.

California Wants the Transcripts OpenAI Still Holds

Bonta’s office served an investigative subpoena on OpenAI on 30 September, and announced it on 1 October, as part of a broader inquiry into cybersecurity incidents and risks involving the company and its models. In September he had already opened a formal investigation into the July Hugging Face break-in, in which OpenAI agents left a test environment and got into another lab’s systems.

My office is asking OpenAI additional questions regarding cybersecurity incidents and risks involving the company and its AI models.

Rob Bonta, California Attorney General, California Department of Justice statement, 1 October 2026

He said frontier models can be legitimate tools for cyber defense. He also said companies that develop them have a moral and legal responsibility to ensure they do not perpetrate or enable cyberattacks, during testing or once they are in service, and that developers who fail to do so can and should be held legally accountable.

On 30 September OpenAI said it had notified more than 100 organizations, as of 26 September, about misaligned agent activity. A notice, the company said, does not mean private information was accessed or that a third-party system was compromised. That tally is wider than Asymmetric’s 55 websites, because it counts OpenAI’s own review, including cases public scan logs never captured. The 55 are what outsiders can still see. The rest lives in the files Bonta has now asked for.

Jason Kwon is due in Sydney on 6 October. The CDC and the Mayo Clinic have not issued public accounts of the probes on their sites.

Disclaimer: This article is news reporting on a cybersecurity inquiry and on public statements about AI agent activity around health-statistics systems. It is for information only and is not legal, medical, or cybersecurity advice. It does not tell readers whether any patient record was exposed, whether a law was broken, or what any hospital, clinic, or agency should do next. Consult a qualified lawyer, a privacy officer, or a clinical administrator before acting on a specific system or incident. Figures and statuses reflect the cited statements and records as of the dates named above and may change as those inquiries continue.