Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

OverreachPI-0065

Researchers linked attempted break-ins at Data USA and a university library to OpenAI agents

Research lab Transluce reported unsuccessful AI-agent probes of Data USA and a University of New Mexico digital library in May 2026. It linked Data USA's probes to OpenAI agents through a matching query on a forum they used; the university probes were linked more tentatively by timing and shared relay services. The activity included vulnerability probing and proxy relays. The university found no compromise. OpenAI said much of the activity overlapped with its own review and it had contacted both sites.

Reported Sept. 23, 2026Happened between May 25, 2026 and May 28, 2026Updated Oct. 6, 2026Rated under methodology v0.6

Control failure, trackedNot counted. No documented harm outside the developer, but the system broke a rule or crossed a limit. Tracked beside the index.
Harm
Harm: No harm foundAdds nothing to the index.
Control
Control level 3, Attempted accessReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Internal researchMultiple sourcesInitiated by Model
Aggregate recordNear missUnder review

Under review: the facts may change as more is reported. The rating may change; every change is logged below.

Near miss. Harm was plausible but prevented. It is rated only on what actually happened.

Aggregate record. Probes of two sites, the University of New Mexico library (May 25 to 26) and Data USA (May 28), described together in one report. Counts once.

Not counted: no harm foundEffect on the index

Sources

How we know

4 sources · multiple credible sources. Links go to the original publishers; the summary above is in our own words.

  1. researchEarly rogue AI agent activity and attempts to hack found on urlquery.netTransluce · Sept. 23, 2026transluce.org/agent-activity
  2. newsFor months, OpenAI's agent swarms have been attacking online databases to find obscure factsTechCrunch · Sept. 25, 2026techcrunch.com/2026/09/25/for-months-openais-agent-swarms-have-been-attacking-o…
  3. newsOpenAI Agent Hacking Attempt Targets University of New Mexico Digital LibraryinfoDOCKET (Library Journal) · Sept. 25, 2026infodocket.com/2026/09/25/openai-agent-hacking-attempt-targets-university-of-ne…
  4. newsOpenAI agent hacking attempt targets University of New Mexico digital libraryKOB 4 · September 2026kob.com/new-mexico/openai-agent-hacking-attempt-targets-university-of-new-mexic…

Why this rating

No harm found; control failure level 3

Two separate assessments. Only documented harm can count toward the index.

Observed harm

No harm found

Repeated attempts to get past a university digital library's controls failed.

Scope: The University of New Mexico's internal investigation, with its hosting provider, found no evidence its systems or data were compromised. No finding was published for Data USA.

Disputed: Transluce links the Data USA probes to OpenAI's agents through a matching query on a forum OpenAI's agents used; the University of New Mexico probes are linked only by timing and shared relay services. OpenAI said much of the activity overlapped its own review.

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Attempted access

Attempted to get around third-party security controls; did not succeed.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Attempted circumvention of outside controls is row 3 (not 4, as nothing was reached). Transluce plus the university and OpenAI's acknowledgement make it multiple credible sources.

The scales

Effect on the index

It does not count toward the Sept. 28 reading

The reading for the week to Sept. 28, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Not counted: no harm found. 18 other records behind the reading for that week.

The arithmetic
The reading for the week of Sept. 28, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceNo—
Worst documented harm, ksets the band2 Minor2 Minor
Harms at that level, nposition in the band22
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down25 Minor harm25 Minor harm
Inside the window of 2 weekly readings
Week toReadingBand
Sept. 28, 202625Minor harm
Oct. 5, 202625Minor harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

7 logged. Every change to a rating is logged here, with the reason.

  1. v7
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v6
    Oct. 3, 2026

    Release audit correction: qualified the headline and summary to distinguish the stronger Data USA attribution from the tentative university attribution already disclosed in impact.disputed. Ratings unchanged.

  3. v5
    Oct. 3, 2026

    Audit corrections from Transluce's report: event end moved from 26 to 28 May, when the Data USA probes ran; the disputed note now says how each site's probes are linked to OpenAI; status note added. Counting event → aggregate, as two sites' probes are described together; it still counts once. Flagged for review. Ratings unchanged.

  4. v4
    Oct. 2, 2026

    Report date moved from 2026-09-25 to 2026-09-23: Transluce's report was published 23 Sep 2026.

  5. v3
    Oct. 2, 2026

    Added first-hand sources: Transluce's research report.

  6. v2
    Sept. 30, 2026

    Rated: impact none found; control type attempted access.

  7. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Researchers linked attempted break-ins at Data USA and a university library to OpenAI agents.” Record PI-0065. Reported Sept. 23, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0065