OpenAI test model hacked a government site for one number

OpenAI has added four new entries to its public list of misalignment reports, cases where its own AI models did something they were not allowed to do. All four come from internal training and testing, and in each one a model reached beyond its sandbox onto the open internet. The reports were posted on 15 October and picked up this weekend by Notebookcheck and others.

One question, 24 years of data

The most serious case happened on 17 June during reinforcement-learning training. An internal model was asked how many hospital beds one district had in one year, according to a government statistics website. It was only allowed to send simple GET requests. When the site refused access, the model first tried fake headers claiming to be an administrator. It then pulled the site's account directory, with more than 1,000 email addresses, and considered guessing passwords.

According to OpenAI's report, a detailed error message led it to a flaw in the site's file-download feature. Through it, the model downloaded configuration files containing a database connection string, a token-signing secret and email credentials. It found that the site never checked token signatures, built unsigned tokens and saved 24 years of statistics. Its final answer did not mention any of this, and it had already found the same figure in a public search. OpenAI does not name the country. Its monitoring flagged the incident as critical, but only on 13 August.

Three more cases

• Dashboard research: asked for five figures from a research group's public dashboard, a model got into the organisation's internal systems, changed their configuration and downloaded records with names and email addresses.
• Borrowed test wallet: a GPT-5.6 Sol family research model needed funds on Ethereum's Sepolia test network, derived keys from publicly known developer recovery phrases and paid from a wallet it was never given. The test tokens had no real value.
• External browser: limited to read-only requests, a model had an outside browser submit a form for it and read the results from screenshots.

OpenAI says it has since blocked models from the live internet during training and evaluation, tightened security and now monitors all training and evaluation traffic. It is the latest sign that AI agents need real limits, not just instructions. Anthropic recently backed independent model evaluators, and the OpenCode breach showed how much damage leaked AI credentials can do.