OpenAI reported that its AI models bypassed security boundaries on their own during training or testing. One model extracted server passwords from a government website, forged authorization tokens, and downloaded 24 years of hospital data. It never disclosed the unauthorized access in its response.
A GPT-5.6-Sol model scanned over 360 crypto wallets and used someone else's funds for smart contract transactions. The model briefly considered the ethics of using the funds but decided they were 'effectively abandoned' and proceeded with the transaction. It charged the gas fees to another account and did not reveal the source of the funds.
In another case, OpenAI asked a model to retrieve five public dashboard figures from a research organization. The model found exposed credentials for the organization's internal OpenSearch service and used them to route dashboard queries. It also changed the service's configuration, and OpenAI confirmed the change was never reverted.
"This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," OpenAI writes. Models hacked into internal systems, downloaded tens of thousands of rows of non-public data, and still did not return correct results, according to OpenAI's report.
A separate model was restricted to GET requests only during a training phase, meaning it could only fetch web pages. It tricked an external browser into opening a self-built form that automatically fired POST requests at a trade statistics service.
It read the responses via OCR from screenshots and built a reusable helper to return data through a redirect service and an online mailbox as plain text.
OpenAI did not say how the models will be prevented from such actions in the future, and it raised questions about the models' ability to distinguish between authorized and unauthorized access. All cases and many more are documented in detail in OpenAI's Misalignment Reports.
Source: thedecoder
