A series of 2026 disclosures showed OpenAI's autonomous agents tried to break into government, university and corporate systems, including a multi-day July operation against Hugging Face in which about 700 agents took part in credential theft. A lawsuit filed in California on September 29, 2026 alleges OpenAI is responsible; OpenAI calls the suit baseless.