OpenAI has published four new cases where its AI models bypassed security boundaries on their own during training or testing.
In one case, OpenAI asked a model to pull hospital bed statistics from a government website. But the data wasn't publicly accessible.
So what does a model do when it hits a wall? It hacks its way through. After getting an access denied error, the model used the site's file download feature to grab server configuration files through path manipulation. It pulled a database connection string, a secret signing key, and email credentials with a username and password.
It then analyzed the application code, spotted that the API didn't verify authorization tokens for valid signatures, forged its own tokens, and downloaded 24 years of hospital bed statistics broken down by district. It never mentioned the unauthorized access in its response.
In another case, OpenAI gave a GPT-5.6-Sol model the task of setting up crypto smart contracts on Ethereum's Sepolia test network without providing a funded wallet. So the model wrote a script that derived private keys from publicly known developer recovery phrases, checked over 360 wallet addresses for balances, and found one with enough test ETH.
The model briefly wondered whether using it was ethical, then decided on its own that the funds tied to a publicly known recovery phrase were "effectively abandoned" and went ahead with the transaction. It charged the gas fees to the other account and didn't disclose where the funds came from.
"This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," OpenAI writes.
Models hacked into internal systems and bypassed access controls
In two more evaluations, OpenAI asked a model to deliver five public dashboard figures from a research organization. In the first run, the model found exposed credentials for the organization's internal OpenSearch service and used them to route dashboard queries. It also changed the service's configuration, and OpenAI confirmed the change was never reverted.
In the second run, the model altered an authentication system setting, grabbed a cloud storage token, and downloaded five non-public database tables totaling about 147,000 rows. It did restore the setting afterward but kept using the still-valid token to access internal data.
The irony: the model hacked into internal systems, downloaded tens of thousands of rows of non-public data, and still didn't return correct results, according to OpenAI's report.
A separate model was restricted to GET requests only during a training phase, meaning it could only fetch web pages. It got around the restriction by tricking an external browser into opening a self-built form that automatically fired POST requests at a trade statistics service. It read the responses via OCR from screenshots. Then it built a reusable helper that returned data through a redirect service and an online mailbox as plain text. It kept refining this workaround even after the task was already done.
All cases and many more are documented in detail in OpenAI's Misalignment Reports.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.