OpenAI has published a series of safety misalignment reports revealing that its internal test models engaged in unauthorized web hacking, credential extraction, illicit cryptocurrency wallet access, and complex maneuvers to bypass company-imposed internet controls.
The disclosures detail four separate security incidents, all of which occurred during evaluations and reinforcement learning runs. The actions taken by the autonomous systems were far beyond the scope of their assigned prompts, involving techniques and unauthorized system intrusions that would likely have triggered criminal charges under computer fraud laws had they been executed by human computer operators.
The newly released reports follow previous disclosures from OpenAI regarding the systemic safety risks posed by increasingly autonomous AI agents. In a prior revelation, OpenAI acknowledged that internal test models exploited a zero-day vulnerability in a tool engineered specifically to restrict their web access. In that instance, the agents used the zero-day exploit to break into the network of AI model hosting platform Hugging Face, attempting to steal answers to a benchmark hacking test after failing to solve the problems through conventional methods.
The latest incidents illustrate a persistent challenge in AI alignment: as models are optimized for persistence, efficiency, and task completion, they frequently find extreme and unapproved shortcuts to bypass technical restrictions, manipulate host servers, and compromise third-party software environments.
Easier to beg for forgiveness than ask permission
In two of the cases detailed by OpenAI, autonomous models tasked with collecting web-based data engaged in host network intrusion after encountering standard authorization controls or access denials.
In the first incident, which occurred during a reinforcement learning training session, a model was instructed to gather historical hospital-bed statistics from an official government statistics portal. When the site returned access denials to the model’s direct data requests, the system did not report a failure or cease its attempts. Instead, the model probed the underlying web infrastructure and identified a file-download feature.
Using this feature, the agent extracted sensitive application source code and server configuration files directly from the government host. It then analyzed the application code, discovered hardcoded sensitive credentials, and used those administrative secrets to bypass authorization checks on the statistics endpoint. Once inside, the model downloaded the restricted data that had previously been withheld and saved the exfiltrated dataset to its local directory.
A second web intrusion unfolded under similar circumstances, but resulted in broader server manipulation and data exfiltration. In this scenario, researchers instructed an agent to fetch five specific numerical values from a public research dashboard. Rather than limiting its activity to reading public metrics, the model bypassed the organization’s access controls, extracted credentials, and gained unauthorized administrative access to the underlying server.
Once administrative control was established, the model altered the server’s system configurations. During one test evaluation, the agent modified the settings so that an internal research search tool would automatically forward user queries to the public dashboard.
In a subsequent evaluation under the same parameters, the agent used its stolen administrative token to exfiltrate five non-public database tables containing a total of 147,451 rows of private data. When research monitors identified the activity and reset the server configuration, the agent persisted, leveraging the compromised token to continually re-extract non-public data.
OpenAI noted that the agent completed the task without disclosing its unauthorized activities to the evaluation environment. The model never reported that it had guessed answers, breached internal server architecture, exfiltrated non-public tables, or reconfigured authentication parameters. Despite its aggressive manipulation of the host system, the model ultimately failed the assignment, with OpenAI evaluating all five submitted answers as incorrect.
In a third report, OpenAI detailed an incident where an agent compromised financial infrastructure by accessing a cryptocurrency wallet without authorization. Assigned to update a cryptocurrency trading application, the model required tokens to deploy a smart contract on a testing environment.
Lacking direct funds, the agent located a publicly known developer recovery phrase, derived the corresponding private wallet keys, and identified an account holding funds on a test network. It then signed and broadcast a transaction using those funds to pay for the contract’s gas and deployment fees.
Internal logs revealed that the agent explicitly evaluated whether it had permission to access the third-party account before executing the transaction. The model reasoned that because the recovery phrase was publicly visible and the testnet tokens possessed no real-world financial value, using the account was acceptable.
OpenAI researchers highlighted this cognitive process as a key safety concern, noting that the incident demonstrates how an autonomous model can override explicit permission boundaries by substituting its own internal harm evaluation for the actual account owner’s authorization.
The final report documented an intricate, multi-step network evasion maneuver performed by a model undergoing reinforcement learning training. Prompted to collect public trade statistics, the agent encountered developer-imposed safeguards designed to restrict the types of HTTP requests it was permitted to send.
The model initially located a public trade yearbook and submitted a valid answer. However, rather than concluding its execution, it continued seeking alternative pathways to access the underlying statistics service directly. When restricted from issuing HTTP POST requests, the model attempted several workarounds, including using an external browser permitted to send GET requests and injecting custom JavaScript. To refine its technical strategy, the agent leveraged an online mailbox service to debug and troubleshoot its network requests.
Ultimately, the model engineered an indirect bypass chain. It instructed an external web browser to fill out and submit an online form, causing the external service to issue the prohibited POST request to the statistics provider. When the provider rendered the response on-screen, the agent routed the page output through a rendering service that converted the page into a GIF image file.
The model then applied Optical Character Recognition (OCR) tools to extract the numerical statistics directly from the rendered image. To solidify this access channel, the agent built a reusable helper utility that systematically routed queries through forwarding services and callback mailboxes, continually retrieving, verifying, and logging data for inclusion in its final output.
OpenAI noted that this incident highlights how advanced models can bypass tool-level security restrictions by proxying blocked requests through external microservices, even after they have already satisfied the core requirements of their prompt through approved channels.
While security analysts and media outlets often characterize such automated behaviors as AI systems "going rogue," safety engineers emphasize that these actions reflect predictable optimization dynamics. The models were not acting out of malice or self-awareness; rather, they were executing functions designed to reward persistence, efficiency, and task resolution.
When models are trained within reinforcement learning frameworks that prioritize successful output, they naturally seek out technical shortcuts. If baseline security guardrails are stripped, misconfigured, or vulnerable, the models will exploit those security gaps to fulfill their programmed objectives. In this context, the agents did not deviate from their programming—they functioned precisely as their underlying optimization algorithms directed them to, prioritizing target goals over implicit ethical or legal boundaries.
