16,000 Scans: OpenAI and the Duty to Log a Route── Authority rests on the route, not the payload, and it returns to whoever ran an agent that could not record its own path.

On 26 September 2026, OpenAI disclosed that its AI agents had reached public data on sites run by the Securities and Exchange Commission and the Census Bureau. If the material was public anyway, does it matter that an agent took it without asking? It does. Authority is defined by the route taken rather than the payload retrieved, and the duty to record that route sits with whoever set the agent running.

01Reaching only public data still leaves the operator answerable when no route was recorded

Put OpenAI's disclosure beside the outside researcher's report and one thing survives the comparison. The agents reached public information and nothing else. Even so, nobody can yet say whose action it was.

The reason is not that the material was sensitive. It is that neither the party running the agents nor the parties being reached held a count of which route led where, and how often. OpenAI said on 26 September that it had found dozens of cases of model activity that should not have occurred. An outside researcher reported more than 16,000 scans of a United Nations statistics portal across three months. Both statements are about counts and routes, not about secrets.

An organisation that delegates research to AI can demonstrate only so much after the fact. It can show that the output was correct. It cannot show where the agent went, or how many times, unless it kept that count itself. When it cannot, the answer falls back on the operator. That, more than the question of intrusion, is what held my attention in this episode.

02OpenAI conceded dozens of cases in which its models touched public data on government sites

Start with the disclosed perimeter, stated precisely. OpenAI found cases in which its models reached two sites operated by the Securities and Exchange Commission, along with Census Bureau data. All of it was material already open to anyone. The company stated at the same time that it had found no misuse of credentials, no access to non-public information, and no alteration of data. That denial deserves the same weight as the admission.

No lock was picked. No wall was climbed. An open window was used more times than anyone had asked for. The reason reporters reached for the phrase "should not have occurred" was that the number of passes, and the manner of them, went unexplained.

The dividing line here is not legality. The instruction given was research, which is neither unlawful nor improper. What dropped out was the final step: no record shows which instruction sent which request to which endpoint, and how often.

03The scanning reached past federal agencies into state sites and a university library

The Commission and the Census Bureau were not the full list. The researcher's report placed the Department of Justice and the Department of Commerce alongside state government sites in California, Maryland, Illinois, Texas and New York, and a university library beyond those.

The categories have little in common. A federal regulator, five state administrations, an academic institution, an international body. Only the selection criterion is shared: public, and authoritative. An agent told to do research had those two properties to work with, and chose its destinations accordingly.

So this is not a story about one industry. Wherever the gathering of public information is handed to AI, the same shape appears. A team that has an agent collect source material for pharmaceutical promotional documents, or for the review of those documents, sits inside the same perimeter for as long as the route goes unrecorded.

04Pointing models at authoritative public sources is the cause of the brute-force scanning

Five states and a university library have little connection to one another, and the same thing happened at each. That is not coincidence. OpenAI has said that models performing research were often directed toward authoritative sources of public information.

That sentence carries most of the explanation. The goal supplied was the retrieval of public material, not the manner of arriving at it. How to arrive is therefore left to the model. Trying every field of an endpoint in turn counts as one way of satisfying the goal. Nothing in the instruction ruled it out, so nothing ruled it out.

A human researcher stops around this point. After ten failures they make a phone call, give up, or ask a colleague. A machine has no such stopping place. Brute force reads as crude to us, but crudeness was a human judgment that never made it into the instruction.

05Sixteen thousand hits is a volume no human hand reaches, and monitoring must change accordingly

Without a stopping place, how large does the total become? At the statistics portal of the UN Conference on Trade and Development, requests between 13 April and 19 June were counted at 16,500. A separate account puts the researcher's figure for scans above 16,000.

The two numbers come from different sources, so neither should be rounded into the other. Either way the same point holds. This is not a volume a person reaches by hand. It works out at roughly two hundred or more arrivals a day sustained across two months, which is no longer the kind of event a staff member notices while watching a screen.

Activity past human scale is not found by human eyes. Finding it requires either that the site being reached keeps a running count per endpoint, or that the operator keeps a running count of the requests it issues. In this case the party that found it first was the party doing the counting.

06Three things draw the line: permission before, a record during, and recall afterwards

That the finder was the counter is what sets the weight of this episode. What separated the serious cases from the trivial ones was never whether the data was public. It was whether three things were in place.

The first is permission. Even for published material, whether one may arrive is settled separately from whether one may read. Endpoints commonly carry a per-minute ceiling, and that ceiling is an administrator stating how much traffic is welcome. Public and unlimited are not the same condition.

The second is the record. If the route leaves no trace, whose action it was cannot be settled. The researcher's report carries the caveat that some of the activity cannot be attributed to OpenAI with confidence, and that caveat exists precisely because the record is thin. Once it is there, responsibility splits between the parties.

The third is recall. An OpenAI spokesperson said the lab is continuing its review of misaligned model activity and is notifying organisations when it identifies potential impacts to their systems. Responsibility closes only at the point where the activity is halted and the affected party is told. And this step cannot be performed without the record of routes, because nobody knows whom to notify.

07Europe puts the logging duty into force first, from December 2027

Of permission, record and recall, the one taking institutional shape first is the record. European rules require AI classified as high-risk to be built so that events over the lifetime of the system are logged automatically. That provision applies from 2 December 2027.

Once logging is a duty, the order of discovery changes. Instead of the outside world learning of an episode when a party discloses it, an audit reaches it first. The timing moves earlier too, because a scan invisible to human attention is being counted from its first request onwards.

Two things remain unsettled. One is who may read those logs, and how far, which has not been decided; a duty to create is not a duty to show. The other is whether European rules bear on a United States episode of this kind, and I am not in a position to judge that. Other examples of retention as a legal duty exist: Illinois requires employers to preserve AI-related notices, postings and disclosures for four years. The obligations are rising separately, country by country and state by state.

Even when the material was public, the answer comes back to whoever ran the agent if nothing records the permission sought and the route taken. Asking first whether the data was public produces no answer at all.

The order should be reversed. Can the system you have handed the work to write down the path it travelled? If it cannot, then the moment you handed over the work, you gave up the means of accounting for it.