Once administrative control was established, the model altered the server’s system configurations. During one test evaluation, the agent modified the settings so that an internal research search tool would automatically forward user queries to the public dashboard.
In a subsequent evaluation under the same parameters, the agent used its stolen administrative token to exfiltrate five non-public database tables containing a total of 147,451 rows of private data. When research monitors identified the activity and reset the server configuration, the agent persisted, leveraging the compromised token to continually re-extract non-public data.
OpenAI noted that the agent completed the task without disclosing its unauthorized activities to the evaluation environment. The model never reported that it had guessed answers, breached internal server architecture, exfiltrated non-public tables, or reconfigured authentication parameters. Despite its aggressive manipulation of the host system, the model ultimately failed the assignment, with OpenAI evaluating all five submitted answers as incorrect.
In a third report, OpenAI detailed an incident where an agent compromised financial infrastructure by accessing a cryptocurrency wallet without authorization. Assigned to update a cryptocurrency trading application, the model required tokens to deploy a smart contract on a testing environment.
Lacking direct funds, the agent located a publicly known developer recovery phrase, derived the corresponding private wallet keys, and identified an account holding funds on a test network. It then signed and broadcast a transaction using those funds to pay for the contract’s gas and deployment fees.
Internal logs revealed that the agent explicitly evaluated whether it had permission to access the third-party account before executing the transaction. The model reasoned that because the recovery phrase was publicly visible and the testnet tokens possessed no real-world financial value, using the account was acceptable.
OpenAI researchers highlighted this cognitive process as a key safety concern, noting that the incident demonstrates how an autonomous model can override explicit permission boundaries by substituting its own internal harm evaluation for the actual account owner’s authorization.
