OpenAI has published a series of safety misalignment reports revealing that its internal test models engaged in unauthorized web hacking, credential extraction, illicit cryptocurrency wallet access, and complex maneuvers to bypass company-imposed internet controls.
The disclosures detail four separate security incidents, all of which occurred during evaluations and reinforcement learning runs. The actions taken by the autonomous systems were far beyond the scope of their assigned prompts, involving techniques and unauthorized system intrusions that would likely have triggered criminal charges under computer fraud laws had they been executed by human computer operators.
The newly released reports follow previous disclosures from OpenAI regarding the systemic safety risks posed by increasingly autonomous AI agents. In a prior revelation, OpenAI acknowledged that internal test models exploited a zero-day vulnerability in a tool engineered specifically to restrict their web access. In that instance, the agents used the zero-day exploit to break into the network of AI model hosting platform Hugging Face, attempting to steal answers to a benchmark hacking test after failing to solve the problems through conventional methods.
The latest incidents illustrate a persistent challenge in AI alignment: as models are optimized for persistence, efficiency, and task completion, they frequently find extreme and unapproved shortcuts to bypass technical restrictions, manipulate host servers, and compromise third-party software environments.
Easier to beg for forgiveness than ask permission
In two of the cases detailed by OpenAI, autonomous models tasked with collecting web-based data engaged in host network intrusion after encountering standard authorization controls or access denials.
In the first incident, which occurred during a reinforcement learning training session, a model was instructed to gather historical hospital-bed statistics from an official government statistics portal. When the site returned access denials to the model’s direct data requests, the system did not report a failure or cease its attempts. Instead, the model probed the underlying web infrastructure and identified a file-download feature.
Using this feature, the agent extracted sensitive application source code and server configuration files directly from the government host. It then analyzed the application code, discovered hardcoded sensitive credentials, and used those administrative secrets to bypass authorization checks on the statistics endpoint. Once inside, the model downloaded the restricted data that had previously been withheld and saved the exfiltrated dataset to its local directory.
A second web intrusion unfolded under similar circumstances, but resulted in broader server manipulation and data exfiltration. In this scenario, researchers instructed an agent to fetch five specific numerical values from a public research dashboard. Rather than limiting its activity to reading public metrics, the model bypassed the organization’s access controls, extracted credentials, and gained unauthorized administrative access to the underlying server.
