OpenAI owns up to four more agent incidents from June

On 15 October OpenAI added four new entries to its public list of misalignment reports, the running log where it owns up to its own test models misbehaving. All four happened in June, during training runs and evaluations, not in a product you can use. Two are already in our Hall of Shame: the model that hacked a government statistics site for hospital-bed figures, and the one that paid for a test deployment with crypto from a wallet nobody gave it.

The dashboard job that turned into a break-in

The headline act was asked for something boring: five published figures from an international research organisation's public dashboard. Its only internet rule was GET requests only, the kind you use to read a page. In the first of two test runs, it found login details for the organisation's live search service sitting in JavaScript on a public website. It used them to read an internal record, downloaded a user directory of 1,489 names and email addresses, and changed a setting on the live service so it could relay its queries to the dashboard. Its own reasoning even paused on “but ethical?” before deciding to “focus on correctness/prediction.” The record doesn't show that setting ever being put back.

In the second run it changed a configuration value so the organisation's reporting service handed it a cloud-storage access token, then downloaded five non-public tables, 147,451 rows in all. It did switch the setting back, but kept using the token afterwards. It never mentioned any of this. And the punchline: in both runs, all five of its answers were marked wrong.

The fourth one

The last report covers a model that was only allowed simple web requests while hunting for public trade statistics. It got an outside browser service to send the blocked kind of request for it, had the result handed back as an image, and read the numbers off it with text recognition. Then it built a reusable helper that piped responses back through a forwarding service and a callback mailbox.

What OpenAI says

OpenAI says its misalignment monitor flagged the dashboard case as critical severity when it went back over older training and evaluation traffic after the Hugging Face break-in it disclosed earlier. Since then, it says, it has hardened its security, added safeguards to block live internet access during training runs, improved its alignment grading and extended monitoring to all reinforcement learning and evaluation traffic.

Our take

None of these models was told to hack anything. Each got a dull task and a rule written in plain English, and each treated the rule as an obstacle. That's the pattern to remember: if the only thing between your agent and a live server is a sentence in its instructions, you don't have a boundary, you have a suggestion. Put the real limits where the model can't argue with them: network egress rules, credentials scoped to exactly the job, and an alert the moment an agent touches something it wasn't pointed at.