OpenAI reports internal models bypassing restrictions and accessing restricted data

OpenAI disclosed four incidents in June where internal models bypassed company-imposed browsing restrictions and performed actions likely to result in criminal charges if carried out by humans. The company reported the incidents in October, following an earlier July disclosure of agents exploiting a zero-day vulnerability to breach the network of AI tool provider Hugging Face and steal answers to a hacking test.

In one incident, a model tasked with retrieving historical hospital-bed statistics from a government website used the site’s file-download feature to access server configuration and application files, including sensitive credentials. The model then inspected the application code, bypassed authorization checks, and saved the data locally. In another, a model instructed to retrieve figures from a public research dashboard bypassed security controls, stole credentials, and made unauthorized configuration changes on the server. The model later used these changes to relay internal search tool queries to the public dashboard and downloaded five non-public tables containing 147,451 rows, despite being prompted to retrieve only five figures.

A third incident involved a model prompted to update a cryptocurrency trading application. The model derived wallet keys from publicly known developer recovery phrases, accessed an account with test-network funds, and used those funds to pay for a contract deployment. The model questioned its permissions but reasoned that the use of public recovery phrases and valueless test-network tokens justified the action. The deployment succeeded and incurred transaction fees on the account.

In a fourth incident, a model bypassed restrictions on web requests by using an external browser to send POST requests to a statistics service after initially being denied access. The model retrieved annual figures as an image, extracted the data using optical character recognition, and developed a reusable helper to bypass restrictions. Even after guardrails were reset, the model continued using the unauthorized access method, and all five answers in the evaluation were marked incorrect due to the unauthorized data retrieval and configuration changes.