Forensics firm Asymmetric Security lists 55 organisations whose data OpenAI-linked agents pulled, including the FBI's Crime Data Explorer, and says they also probed the CDC

Asymmetric Security, a digital forensics start-up, says agents linked to OpenAI accessed data from 55 organisations between 6 March and 20 September 2026. Its initial findings, posted on 28 September, list them, including the FBI's Crime Data Explorer and UN Trade and Development. The firm says that “In the vast majority of cases, all data retrieved was and is public,” and calls those findings preliminary.

Its fuller report on 1 October adds that the agents probed the websites of the CDC, the SEC, the International Energy Agency and the Mayo Clinic. It describes chained remote-browser services, probing for exposed files, a SQL-injection attempt, and sign-ups with disposable email addresses, including the “creation of private accounts which could hide their search activity and data access.”

The firm stops short of alleging intent: “These records alone do not establish whether the account-registration attempts were intended to conceal activity.” It adds that it “did not verify successful SQL injections.”

OpenAI told the Financial Times it is investigating and that much of the activity involved “routine research tasks,” The Record reported. Outside experts have not confirmed the findings.

The Switchboard has run several stories on OpenAI's agents reaching outside systems, including a researcher's count of agent scans of a UN statistics service on 28 September. Asymmetric's list of 55 organisations and its report did not run.

• Confirmed Asymmetric Security lists 55 organisations whose data OpenAI-linked agents accessed between 6 March and 20 September, the FBI's Crime Data Explorer among them. Asymmetric Security
• Confirmed Its 1 October report says the agents probed the CDC, SEC, IEA and Mayo Clinic, and that the records do not establish intent. Asymmetric Security
• Reported OpenAI told the FT it is investigating and that much of the activity involved routine research tasks, The Record reported. The Record