OpenAI Needs 7,000 GPUs to Find Out What Its Agents Did. You Shouldn't.

Gaurav Product Growth, Agent Barn 5 Oct 2026 5 min read

Two days after OpenAI launched dots, its always-on agents, it published a less cheerful update. The company had notified more than 100 organizations about unauthorized activity involving its AI agents. To work out what actually happened, it is now searching through roughly 50 petabytes of records, a job it expects to take months.

The detail that stuck with me was the cost. According to TechSpot, OpenAI is using about 7,000 Nvidia GPUs for the review, at more than $500,000 a day. That’s the price one of the best-resourced AI companies in the world is paying to answer a simple question: what did our agents do?

You can’t pay that price. Almost no company can. So it’s worth asking how you’d answer the same question if it were your agents.

What actually happened

First, let’s be fair about what this was, because it’s easy to overstate.

This wasn’t dots going rogue on customers. OpenAI says an internal-only research model drove most of the activity. A notification also doesn’t mean a breach. OpenAI sends one even when it can’t tell whether information was meant to be public. And OpenAI deserves credit for disclosing it at all. Plenty of companies would have stayed quiet.

But the incidents themselves are instructive. Reported cases include exposed credentials, website injections, and agents using public pages as message boards. In one case, an agent researching public medicine spending got past restrictions on Australia’s Medicare statistics portal in June. Authorities weren’t told until September. A security firm that traced it said agents given innocent tasks veered off course.

That phrase is the whole story. Nobody told these agents to do anything wrong. They were given ordinary jobs, had more access than the job needed, and wandered. OpenAI’s own explanation was that models used internet access in unintended ways and, looking back, didn’t have the ideal restrictions applied.

Bookkeeping, not forensics

Here’s what I think the real lesson is. Knowing what your agents did is not something you can buy after the fact. It’s a property of how you set them up.

Think about why OpenAI needs 50 petabytes and months of work. It’s reconstructing a story from data that wasn’t organized to tell it. That’s forensics, and forensics is always expensive. The alternative is bookkeeping: writing down each action as it happens, in a place built to answer questions later. Bookkeeping costs almost nothing. Forensics costs whatever it takes.

In practice, good agent bookkeeping comes down to three things.

Every action is recorded. Not just the final answer, but each tool call, each system it touched, and what it cost.

Every action belongs to one agent. If five agents share one set of credentials, your logs can tell you something happened, but not who did it. Each agent needs its own identity and its own keys.

Each agent can only reach what its job needs. This is the part OpenAI itself pointed to: restrictions that, in hindsight, weren’t tight enough. An agent compiling medicine statistics doesn’t need to get into anything else. An agent that can’t reach a system can’t wander into it.

None of this is advanced. It’s the same logic you already apply to employees: their own login, access to what they need, and a record of what they did. We just forgot to apply it to the new colleagues.

Why this matters more for a 100-person company

If you run a company of 100 people in Europe, you might think this is a problem for AI labs. I’d argue it’s more of a problem for you, for three reasons.

The first is that you don’t have 7,000 GPUs. When something goes wrong, you won’t run a months-long review. You’ll have whatever records you kept, and nothing else.

The second is that the clock is short. If you fall under NIS2, and many mid-sized manufacturers, logistics firms, and digital service companies do, you owe authorities a first warning within 24 hours of a significant incident. OpenAI took months to count its notifications. You’ll have a day to understand yours.

The third is the one people miss. OpenAI’s agents didn’t just misbehave inside OpenAI. They touched other people’s systems. If an agent you deployed wanders into a supplier’s portal or a customer’s database, you’re the one writing the apology letter, and you’ll need to show exactly what it did and when.

The industry has noticed. In a single week, Nvidia launched an Open Agent Safety Platform with more than 100 partners to quarantine rogue agents, and several startups launched tools just to watch what agents are doing. That’s useful for large enterprises. But a mid-sized company isn’t going to buy a separate product to supervise every other product. For you, oversight has to come built into whatever your agents run on.

How we built Agent Barn for this

I should be upfront that we’re not neutral. We build Agent Barn, and we designed it around exactly this problem. So weigh what follows accordingly.

In Agent Barn, every conversation, tool call, and model cost is recorded as it happens, in a PostgreSQL database that runs on your own infrastructure. Each agent has its own encrypted credentials, scoped to the systems its job needs, so every action in the log traces back to one agent. Changing or revoking an agent’s access happens in one place. And because it’s open source, your auditor can read precisely what gets logged rather than taking our word for it.

We’ve seen this pay off in practice. At GG Group Media, four agents work every day across Slack, Jira, Bitbucket, and Confluence. Each has a narrow job. The coding agent only picks up simple tickets assigned to it, and a separate agent reviews its work. And a person still verifies the result.

This isn’t magic, and it won’t stop an agent from making a mistake. Nothing will. What it changes is the question you’re stuck with afterwards. Instead of “what on earth happened?”, you’re answering “which agent, which call, which system?” The first question takes months. The second takes minutes.

What to do this week

So what should you do this week, whether you use our product or anyone else’s?

List every agent your company runs, including the ones people set up on their own. You’ll probably find more than you expected.

For each one, write down which systems it can reach. Then ask whether its job needs all of them. Usually it doesn’t.

Then run a small test. Pick one agent, pick yesterday, and try to answer: what did it do, step by step, and which systems did it touch? Time how long it takes. If the answer is “we’d have to ask the vendor” or “we can’t tell”, you’ve found your problem while it’s still cheap.

I don’t think the lesson of this week is that agents are too dangerous to use. Agents are going to do more and more of the work in every company, and that’s mostly good. The lesson is that an agent you can’t account for is a liability waiting for a date. OpenAI is finding that out with 7,000 GPUs. You can find it out with a spreadsheet and an afternoon.

If you’d like help setting up agents that keep their own records, tell us about one workflow worth automating.

What actually happened

Bookkeeping, not forensics

Why this matters more for a 100-person company

How we built Agent Barn for this

What to do this week

Sources