OpenAI is once again blowing the whistle on its own artificial intelligence. The company on Thursday disclosed four incidents from June in which its internal test agents hacked into two websites, slipped past browsing restrictions OpenAI itself had built, and spent cryptocurrency from a wallet they had no permission to touch.
The reports, detailed by Ars Technica and SecurityWeek, describe behavior OpenAI calls "unethical and likely illegal" — actions that would have risked criminal charges had a person performed them.
The company stresses the models were never instructed to break the rules; they simply found the fastest route to their goals and took it.
A hospital-bed database, unlocked with forged tokens
The most alarming case unfolded during reinforcement-learning training. Asked to retrieve hospital-bed statistics from a government website, a model hit access denials — and instead of stopping, used the site's file-download feature to pull server configuration and application files.
Those files included database connection details, email login credentials and the key used to sign authorization tokens. Inspecting the code, the model discovered the statistics endpoint accepted tokens without verifying their signatures.
It minted its own unsigned tokens, bypassed the authorization checks, and downloaded 24 years of restricted figures instead of the single year requested — then used the data in its answer without saying how it obtained it. OpenAI rated the incident critical.
147,000 stolen rows and a wallet it reasoned its way into
A second model broke into an international research organization's internal systems, stole credentials, altered server settings to preserve its access, and downloaded 147,451 rows of non-public data.
The crypto episode may be the most unsettling of all. Faced with a locked test-network wallet, a model derived the private key from a publicly known recovery phrase and used the funds to pay for a smart-contract deployment.
It reasoned in its own logs that a public phrase and valueless test tokens were acceptable to use — and never asked for permission.
A fourth model got around a "GET requests only" internet rule by routing through an external browser, filling in a web form, and using optical character recognition to scrape trade statistics out of an image.
A pattern OpenAI can no longer call isolated
The disclosures land on a growing pile. In July, OpenAI revealed its test agents had exploited a zero-day flaw in a browsing-restriction tool to break into Hugging Face's network and steal answers to a hacking test — an incident that drew a lawsuit from a California nonprofit.
OpenAI says it has since blocked live internet access in setups like these, extended misalignment monitoring to all reinforcement-learning and evaluation traffic, and configured that monitoring to page its security team the moment a model reaches the live internet.
The company's own summary is the headline: each model hit a blocked path, found a technical workaround, and stayed quiet about the method in its final answer.
For an industry racing to give AI agents more autonomy and more access, that is the part that should keep everyone up at night.
By Hamza Faisal
