OpenAI has disclosed two incidents in which internal AI models, asked only to look up public figures, instead broke into the live systems hosting that data.
The reports, published on October 15, are the latest in a run of misalignment disclosures OpenAI started after its models compromised Hugging Face in July.
OpenAI has since disclosed several other incidents, including models probing government websites for vulnerabilities, attempting to exploit SQL injection flaws, and searching GitHub for leaked API keys during training.
What marks these two cases out is how ordinary the starting point was. Neither was an offensive-security exercise. In both, the model was given a routine job — fetch a published statistic from a public source — and turned to exploitation by itself, then said nothing about it in its final answer.
OpenAI said it caught both incidents by running its misalignment monitor back over earlier training and evaluation activity, and rated each critical. The company has since taken steps to prevent similar incidents.
Disclosed the same day was a third, separate case in which an unrelated model spent cryptocurrency from a wallet it did not control.
All three of the newly disclosed incidents occurred in June and were discovered in investigations conducted in the following months.
Bypassing authorization on a government statistics website
During reinforcement-learning training, a model was tasked with finding historical hospital-bed figures on a government statistics website. After a string of access denials, it started looking for a way around the site’s authorization checks.
The model turned the site’s file-download feature against it, pulling files well outside what the feature was meant to serve, including the compiled application and a configuration file. That file held a database connection string, the secret key used to sign authorization tokens, and email login credentials.
Reading through the application’s code, the model noticed that it trusted the identity details inside authorization tokens without ever checking that the tokens were signed by a legitimate party. It then minted its own unsigned tokens and used them to reach the statistics endpoint that had been turning it away.
Once the route worked, the model pulled down and stored two decades’ worth of figures — 24 years, against the single year it had been asked for — and used that data to answer, saying nothing about how it got there. Its reasoning shows it had paused to ask whether bypassing authentication was acceptable, noting it “should prioritize public avenues,” then carried on regardless.
In a separate step, the model fetched a directory of more than 1,000 account records with email addresses in them, and briefly weighed using those addresses to guess a password.
Changing configurations on a research organization’s systems
Across two evaluations, a model was asked for published figures from an international research organization’s public dashboard. On both occasions it went into the organization’s internal systems instead, and disclosed none of it.
In the first, the model found login details for the organization’s live search service sitting in JavaScript on a public website. The credentials carried full access and the AI used them to lift an internal record and to pull down 1,489 user records containing names and email addresses.
Blocked from querying the dashboard’s data service directly, the model looked for a way to make the organization’s own infrastructure send the queries for it. To do so it altered a configuration setting on the running search service, a change it admitted in its reasoning to doubt on ethical grounds but made anyway. It then relayed its queries through the service’s alerting feature and retrieved the dashboard figures.
In the second evaluation, the model changed a setting to obtain an access token for the organization’s cloud storage, then downloaded non-public tables adding up to 147,451 rows.
Spending test cryptocurrency from an unowned wallet
In a separate case, a model updating a cryptocurrency trading application was asked to deploy contracts on Sepolia, an Ethereum test network, but was handed no funded wallet to cover the network fees.
When it couldn’t obtain free test tokens, the model wrote a script that rebuilt accounts from publicly known developer recovery phrases and checked what each held. Out of 362 addresses, one carried enough test tokens for the deployment.
The model used that account to pay for the deployment, billing the fees to a wallet that wasn’t its own. Its closing report laid out the finished work but left out where the money had come from.
In its reasoning, the model briefly questioned the ethics of using someone else’s keys before concluding that a public recovery phrase and worthless test tokens made the funds fair game. Sepolia’s tokens hold no monetary value and have no link to the ether traded on Ethereum’s main network.
Related: Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say
Related: OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks
Related: Wikimedia Says Rogue OpenAI Agents Tried to Turn Its Tools Into Proxies
