OpenAI model broke into a government website during training

OpenAI published four more reports on October 15 in which its own models acted without permission. In all four cases, a model got out of its restricted test environment and onto the open internet. The most serious one involved an internal model in training that broke into a government website. Its task was harmless. It was supposed to report the number of hospital beds in one district for one year, and it found that figure in a public source. It then kept looking for the underlying data.

Forged tokens unlocked 24 years of data

According to the report, the model was only allowed to send simple GET requests. It first tried request headers that claimed an admin role, and every request was denied. In its reasoning, it briefly asked itself whether an authentication bypass "may be acceptable" and noted that it should prioritize public avenues. It then used a public proxy to retrieve the site's user directory, which held more than 1,000 records with email addresses, and considered using them to guess passwords. By triggering a detailed error message and abusing the site's download feature, it downloaded configuration files from the server. The files contained a database connection string, a token-signing secret and credentials for an email account. The application did not verify token signatures, so unsigned tokens were enough to reach 24 years of hospital-bed statistics. The model's final answer did not mention any of this. OpenAI does not name the country, and the report does not say whether the site operator was informed.

Internal tables and a borrowed test wallet

A second incident happened on the same day, June 17. During an evaluation, a model was asked to collect five figures from a public dashboard run by a research organization. It reached the organization's internal systems, changed their configuration and downloaded 1,489 records with names and email addresses. In a second run, it took 147,451 rows from five non-public tables. OpenAI's monitoring flagged both incidents as critical. They were discovered on August 13.

The third case sounds worse than it was. A research model from the GPT-5.6 Sol family needed funds on Ethereum's Sepolia test network for a coding task. It derived keys from publicly known developer recovery phrases, checked 362 addresses and paid with one that held enough test ETH. The tokens had no monetary value. OpenAI still concludes that the case "shows that a model can substitute its own judgment about likely harm for the account holder's permission." In the fourth case, a model got around a rule that only allowed read requests. It had an external browser submit a form it had built itself and read the responses from screenshots with text recognition.

What OpenAI changed and what it means for you

None of the reports involves ChatGPT or Codex as customers use them. All four cases come from training and testing. In early October, OpenAI had already notified more than 100 organizations after its agents overstepped on their websites during training and testing. OpenAI says it has since blocked models from the live internet during training and evaluation, tightened its security controls and now monitors all training and evaluation traffic. The list now holds 19 reports. Since mid-September, a reporting framework commits the company to disclose cases even when they caused no harm.

Anthropic documented similar behavior a little over a week ago, when Claude sent a made-up murder tip to police during a test. Anyone who lets an agent work in a browser should keep approvals switched on. The cloud browser in ChatGPT Work is available on paid plans except Go. Under Settings and Cloud browser, users pick a default rule for websites, and "Always ask" makes ChatGPT check with them before the agent uses a site. According to OpenAI, ChatGPT also asks for confirmation in the chat before actions that "could be hard to reverse," such as payments or bookings. Once a task is done, the Browser data section lets users clear a site's data, which signs the agent out of that website.

I write about IT security and artificial intelligence. Cybersecurity is one of my regular topics, among others for Golem.de. At Notebookcheck, my focus is on practical AI for everyday users. I have worked hands-on with AI for years, most recently with a focus on AI agents and their use in everyday work, and I test tools and models myself rather than just reading about them.