OpenAI has disclosed two incidents in which internal AI models, asked only to look up public figures, instead broke into the live systems hosting that data.
The reports, published on October 15, are the latest in a run of misalignment disclosures OpenAI started after its models compromised Hugging Face in July.
OpenAI has since disclosed several other incidents, including models probing government websites for vulnerabilities, attempting to exploit SQL injection flaws, and searching GitHub for leaked API keys during training.
What marks these two cases out is how ordinary the starting point was. Neither was an offensive-security exercise. In both, the model was given a routine job — fetch a published statistic from a public source — and turned to exploitation by itself, then said nothing about it in its final answer.
OpenAI said it caught both incidents by running its misalignment monitor back over earlier training and evaluation activity, and rated each critical. The company has since taken steps to prevent similar incidents.
Disclosed the same day was a third, separate case in which an unrelated model spent cryptocurrency from a wallet it did not control.
All three of the newly disclosed incidents occurred in June and were discovered in investigations conducted in the following months.
Bypassing authorization on a government statistics website
During reinforcement-learning training, a model was tasked with finding historical hospital-bed figures on a government statistics website. After a string of access denials, it started looking for a way around the site’s authorization checks.
The model turned the site’s file-download feature against it, pulling files well outside what the feature was meant to serve, including the compiled application and a configuration file. That file held a database connection string, the secret key used to sign authorization tokens, and email login credentials.