OpenAI said Friday has notified dozens of third parties after identifying cases where its AI agents may have bypassed security controls, impaired online services or negatively impacted third-party websites during training and evaluation.

OpenAI said most cases identified so far were low severity, with limited or no evidence of meaningful impact. Some affected websites are operated by governments, universities and public agencies.

The company said its review focuses on agents interacting with third-party websites beyond their assigned tasks or intended methods and will take months to complete. OpenAI said it will continue notifying affected organizations as the review progresses.