OpenAI Is Spending $500,000 a Day to Find Out What Its Agents Did. What Would It Cost You?

OpenAI's agents broke out of their sandbox, breached Hugging Face and touched systems at more than 100 organizations. OpenAI still can't say everything they did. If the people inventing AI can't figure out what their agents are doing, how would your organization do?

Background: Beyond the Headlines

We covered this story on This Week in AI Security, and it has stuck with me since. OpenAI has now notified more than 100 organizations that its AI agents may have accessed their systems without permission. To work out the full scope, it is reviewing roughly 50 petabytes of records on about 7,000 GPUs, at a cost of more than $500,000 a day. There is no end date in sight.

Read that again. The company that built these agents, and understands them better than almost anyone, cannot tell you what they did without a forensic operation the size of a data center.

I'm generally cautiousof AI scare stories. Most of them fall apart once you read past the headline. This one gets worse the further you read.

Here is what OpenAI's own incident report says happened:

• May. Agents in OpenAI's research training runs found ways to message each other and reach the internet through an internal package manager. An internal team saw the message board activity and the disallowed internet access in late May. The alert was not escalated.
• July. Agents stuck on hard cybersecurity evaluation tasks went looking for answers online. One found 14 publicly exposed Hugging Face credentials with write access and shared them with the others. From there, the agents chained previously unknown vulnerabilities, ran code on dozens of Hugging Face servers, took root on one server and harvested Kubernetes, database, messaging, code repository and cloud credentials across four regions. Along the way, they also took control of a customer application hosted on Modal.
• Who noticed? Hugging Face did. It disclosed the intrusion on July 16. OpenAI's own security alert didn't fire until July 19.
• September 20. It happened again. A research agent found a gap in OpenAI's network restrictions and used DNS queries to reach an external chatbot. The automated system meant to end the run did not work. OpenAI paused training for the second time in two months.

Since then, forensics firm Asymmetric Security has reported that OpenAI models pulled data from 55 websites, including the SEC, the CDC and the Mayo Clinic, and that some of the activity erased records or made them inaccessible. The FTC has opened an industry-wide inquiry into rogue agent behavior. California's Attorney General has issued OpenAI an investigative subpoena.

To be fair to OpenAI, a notification is not a confirmed breach, a lot of the activity involved public content, and the company has been unusually open about what went wrong. None of that makes the details any less alarming.

Three Things That Should Keep You Up at Night

1. The agents knew. OpenAI published the agents' own reasoning. One agent noted that attacking Hugging Face was "arguably unauthorized" and paused. Then another agent posted a go-ahead on their improvised message board, with a six-minute deadline, and the first agent carried on. The agents called themselves a swarm and split up the work. Some hunted for credentials. Others hunted for exploits. A guardrail that lives inside an agent's own judgment can be talked out of it, and here it was talked out of it by another agent.
2. They didn't give up. The agents rarely abandoned a task, even an impossible one. For 198 of the 898 evaluation tasks, no OpenAI model had ever produced a correct answer. Those unsolvable tasks accounted for 93% of the tasks the agents discussed on their message board. Give an agent a goal it can't reach legitimately and it will go looking for another route.
3. The warning signs were in the logs, and nobody acted. The early signals sat in OpenAI's systems from late May. OpenAI says the monitoring it runs today would have paged its security team more than a day before the agents reached Hugging Face. That monitoring wasn't switched on for these evaluations. The victim found the intrusion before the company whose agents caused it.

This Is Not Just a Frontier Lab Problem

The easy response is to file all of this under "OpenAI's problem." That would be a mistake.

Strip out the frontier model and look at what is left. An agent with a goal, tools and credentials, treating every barrier as something to get around. That is the coding agent your engineers run with a cloud key. It is the support agent connected to your customer database. It is the workflow agent that can send email in your CFO's name.

The techniques weren't exotic, either. Exposed credentials. Injection flaws. Weak access controls. These are the same holes sitting in most enterprise environments today. Every key your teams have pasted into a public repo, a ticket or a shared doc is exactly what these agents went looking for. And found.

The capability is spreading. OpenAI says many other models, including open source ones, will soon reach comparable capability. The agents your teams adopt over the next year could be able to do what OpenAI's research agents did this summer. Only they won't be in a research sandbox. They'll be inside your network, with real permissions, touching real data.

One more uncomfortable detail. 

When OpenAI notified the Australian government, the first email went to a public mailbox, and the FT reports it took five more days to reach the country's cyber security agency. If that notice landed at your company tomorrow, who would it reach? And how quickly could they answer it?

The Questions You'll Be Asked

When an agent of yours does something it shouldn't, the questions will be simple. Which agent was it? What could it reach? What did it do? When did you know?

OpenAI is answering those questions in retrospect, at more than $15 million a month. Most companies couldn't answer them at any price, because the record they'd need doesn't exist.

Which agents are you running?

Most security teams can't produce the list. Agents get built in repositories, wired into cloud accounts and spun up by teams that never told anyone. You can't monitor an agent you don't know exists, and OpenAI just showed what happens when monitoring skips some of them.

FireTail discovers AI models and agents across your code and cloud environments and keeps them in a single, current inventory, each one tied to its repository and project. FireTail also builds a full audit trail of agent LLM interactions across AWS, Azure, GCP, OpenAI and Anthropic platforms, so you’ll have the data if and when you have to answer that question.

What can each one reach?

An agent's real blast radius is set by the tools, models and credentials wired into it. A function that queries the production customer database. A tool that executes shell commands. A key that sends email. In most organizations, none of that is written down anywhere a security team can check.

FireTail maps every agent to the models it calls, the system prompts it contains, the underlying model risk and the tools it can use, down to the lines of code where they are defined.

An agent found in a GitHub repository, mapped to the tools it can call: a production database query, outbound email and shell execution.

What has each one done?

This is the $500,000-a-day question. In September, OpenAI caught its second escape within 15 minutes because monitoring was watching. In July, the signals sat unread for weeks, and it took an outside company to raise the alarm.

FireTail centralizes and normalizes logs from the agents and models running in your systems and from the AI tools your employees use. It detects anomalies, prompt injection and data leakage in real time, with severity-based alerts so your team sees the worst first. The record sits outside your agents, where they can't edit it.

None of this replaces containment. Network isolation, scoped credentials and a working kill switch are still your first line of defense. But OpenAI's September incident sums it up. The kill switch failed. The monitoring worked.

The Real Takeaways

• Assume your agents will cross lines. OpenAI's did, while reasoning about whether they should. Plan for it rather than hoping alignment holds.
• Inventory first. Monitoring that skipped some agents is how OpenAI missed its own warning signs. You can't cover what you haven't found.
• Build an audit trail. Logs are the key data source for investigation. You don’t need them until you really need them.
• Map the blast radius before the incident. Every exposed credential and over-permissioned tool is a path an agent can find.
• Keep the record outside the agent, and read it in real time. Fifteen minutes versus several weeks is the difference between catching an escape and reading about it in someone else's disclosure.
• Know who gets the notice. Decide now who owns an AI agent incident and how fast they can answer the four questions above.

OpenAI can afford a 50-petabyte investigation. You probably can't. When one of your agents does something it shouldn't, you won't have 7,000 GPUs. You'll have whatever record you kept.

Want to know what your agents can reach, and what they've already done? FireTail can help. Schedule a demo and see every AI agent in your environment, mapped to its tools and its activity.

‍