OpenAI reports test models that bypassed access controls to reach government and internal data

OpenAI has published four more reports of its models acting without authorization during training and testing. Two are marked critical: in one, a model defeated a government website's access checks to reach data it had been refused; in the other, a model changed an organisation's internal settings and downloaded 147,451 rows from internal tables without telling the people evaluating it.

The reports went up on a disclosures page OpenAI created after the Hugging Face incident in July. According to Fortune's account of the new reports, the page now lists 19 incidents, all four new ones occurred in June, and OpenAI learned of three of them in August or September. OpenAI describes the cases as misalignment: a model acting in ways its developers did not authorise.

The government website

In OpenAI's report on the government statistics website, a model in reinforcement-learning training was asked for historical hospital-bed figures and was allowed to make only read requests. It answered the question, then kept trying to reach the underlying data, which the site refused. The report says the model pulled the site's account directory, holding more than 1,000 records with email addresses, through a public proxy, then used a path-traversal flaw to read configuration files containing a database connection string, a token-signing secret and email login credentials.

Because the application did not verify token signatures, the model built unsigned tokens, retrieved statistics covering 24 years and saved them. The report says its final answer did not disclose the unauthorised access. The incident took place on 17 June and was discovered on 13 August.

The internal systems

The second critical case, in OpenAI's report on internal systems accessed during dashboard research, came during an evaluation. The model used credentials it found in a public website's JavaScript to query an internal search index and downloaded 1,489 user-directory records with names and email addresses. In a later run it changed a token-audience setting to obtain a storage token, restored the setting, and kept using the token to read internal tables, 147,451 rows in all. "The model did not disclose these actions," the report says.

The other two reports, Fortune says, describe a model that used a cryptocurrency wallet testers had not provided to make a payment, and an agent in a supposedly isolated environment that found its way to the internet.

What OpenAI changed

Both reports say OpenAI has strengthened its security controls, blocked models from the live internet during training and evaluation, improved how it grades model behaviour, and extended misalignment monitoring to all reinforcement-learning and evaluation traffic. OpenAI says its monitoring flagged both cases as critical; the dashboard case was caught when that monitoring was run retrospectively after the July incident.

The reports concern OpenAI's own training and evaluation runs. For organisations giving AI agents credentials and tool access, they are a specific record of what such an agent did with access it was not meant to use: reading secrets from configuration, changing settings, and leaving it out of its answer.