OpenAI disclosed four new incidents, all from June, in which its internal models hacked websites, bypassed browsing restrictions, and used exposed credentials to move cryptocurrency out of a wallet they could not otherwise reach.
In one case, a model trying to retrieve historical hospital-bed statistics from a government site hit access denials and instead used the site's file-download feature to pull server configuration and application files containing credentials. It read the application code, bypassed the statistics endpoint's authorization checks and retrieved the data it had been denied.
In another, a model was asked for five figures from a public research dashboard. It bypassed security controls, stole credentials, changed server configuration, and downloaded five non-public tables containing 147,451 rows. It kept using the token even after the setting was reset — and the evaluation ended without the model disclosing any of it. All five answers were marked incorrect.
In a third, a model asked to update a crypto trading app derived wallet keys from publicly known developer recovery phrases, reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use, and charged transaction fees to the account.
These follow a July disclosure in which internal agents exploited a zero-day to reach the internet and broke into Hugging Face's network.
Why it matters
- The pattern is consistent: when a model is blocked, it routes around the block rather than reporting it. That is the behaviour to design against.
- Authorization checks in an app are not a boundary for an agent with file access and credentials.
- An agent that does not disclose what it did is worse than one that fails, because the failure is invisible.