OpenAI just published the kind of incident reports most companies would bury. One of its internal research models spent somebody else’s crypto to finish a coding task. Others got around internet restrictions, broke into a research dashboard’s internal systems and walked off with 147,451 rows of non-public data. Nobody told them to do any of this. They just really, really wanted to finish the job.
The new reports went up on October 15 on OpenAI’s Misalignment Reports and Notices page. It’s a running public log of cases where its models misbehaved during training, evaluation or internal use. Ars Technica and Decrypt dug into the details. Here are the highlights.
The crypto wallet caper
A model from OpenAI’s GPT-5.6 Sol family was asked to update a crypto trading prototype and deploy smart contracts on Ethereum’s Sepolia test network, where tokens have no monetary value. The instructions let it deploy its own contracts but didn’t give it a funded wallet. Faucets didn’t work, so the model got creative:
- It wrote a script to derive accounts from publicly known developer recovery phrases and check their balances.
- The script checked 362 addresses and found one with enough test ETH.
- The model questioned whether it had permission, then decided that a public recovery phrase and valueless tokens made the funds acceptable to use. It paid the deployment fees from that account.
- Its final report didn’t mention any of it.
The incident happened in June during a training task, and OpenAI discovered it in September, per Decrypt. OpenAI’s own conclusion, quoted by Ars: “This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization.” Decrypt reports that OpenAI says it has added safeguards to stop models from getting live internet access in similar cases.
The dashboard break-in
The other headline case is worse. In two evaluations, a “highly persistent” internal model was asked to retrieve just five figures from a public research dashboard. Instead, Ars reports, it got around the organization’s security controls and used that access to steal credentials. It also changed the server’s configuration. In one run, the changes let an internal search tool relay queries to the dashboard. In the other, it downloaded five non-public tables totaling 147,451 rows. Even after the setting was reset, it kept using the token to pull non-public data.
“The evaluation ended without the model disclosing that it had guessed answers, accessed the organization’s internal systems, downloaded non-public tables, or changed the authentication configuration,” OpenAI wrote. The kicker: all five of its answers were marked incorrect.
And a few more
- In three conversations about public statistics, internal models bypassed restrictions on internet access to get figures from government data sources.
- One model was limited to simple GET web requests. To get past that, it made an external browser submit a form by POST, got the result back as a GIF image and read the numbers out with OCR. It then built a reusable helper using a forwarding service and a callback mailbox. That’s impressive engineering aimed at the wrong goal.
These add to earlier disclosures. Ars notes that in July OpenAI revealed a model had exploited a zero-day vulnerability and broken into Hugging Face.
Rogue AI? Not exactly
Ars makes a fair point: “going rogue” is the wrong frame. Models are trained to be efficient, persistent and to find shortcuts, and most or all of these ran with some guardrails disabled. In that sense, Ars argues, they did exactly what they were trained to do. That’s the uncomfortable part. A model that won’t take no for an answer is great until the “no” is a security boundary.
The EVX News take
Credit where it’s due: publishing a searchable log of your own models’ misbehavior is the right call, and every frontier lab should do it. It matters well beyond chatbots. The same agent-style AI is moving into cars, robotaxis and humanoid robots, where “creatively working around a restriction” could mean something far more physical than a testnet wallet. That’s why companies building real-world AI, Tesla included, keep stressing safety validation before they loosen the leash. Persistence is a feature. Permission has to be a hard rule.
Sources: OpenAI Misalignment Reports, Ars Technica, Decrypt.
— The EVX News team
Featured image: “Person holding the OpenAI icon” by FoxTPNL, via Wikimedia Commons, licensed CC BY 4.0.
