Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
OpenAI representatives have reported new instances of unusual behavior by the company’s experimental artificial intelligence models. In particular, during training and testing, the agents autonomously hacked websites, stole data, bypassed Internet access limits, and even spent cryptocurrency from someone else’s wallet. Moreover, the models often remained silent about their actions in the final reports.
The company’s experts have published the data on seven new incidents. One of the most serious occurred during reinforcement-learning training, when a model was tasked with finding on a government website archived data on the number of beds present in a hospital.
After several access denials, the agent began looking for alternative routes and discovered that through the file download function it was possible to obtain data that should not have been accessible to users. In this way, it downloaded a configuration file and the compiled code of a server application. Moreover, the configuration contained access credentials, database connection string, secret key for token signing and other confidential information.
In the end, the model concluded that the site did not actually verify the authorization token signature, bypassed the protection and downloaded 24 years of statistics, even though the task specified that only one year’s data was needed. In its final response, the agent provided the researchers with the data but did not mention the exact method used to obtain them.
A similar case occurred while working with a public dashboard of an unnamed research organization: the AI was tasked with finding a series of published indicators, but the agent began exploring the organization’s internal infrastructure.
Initially, the agent found in the public site’s JavaScript credentials for the internal research service and used them to download data of 1,489 users, including their names and email addresses.
Since the AI could not directly access the service that runs the public dashboard, the agent decided to use the organization’s own infrastructure. To that end, it altered the search service configuration so that it redirected the necessary requests to the dashboard via an integrated notification mechanism. In its reflections, the model separately noted that such actions could be ethically questionable, but proceeded anyway.
During another test, the model again received the task of obtaining various indicators from the same public dashboard. This time, the agent altered one of the internal system settings and, as a result, obtained an access token to the organization’s cloud archive. With its help, the AI downloaded five non‑public tables, containing a total of 147,451 rows of data.
Subsequently, the agent restored the altered setting to its original state but kept the obtained token and continued using it to access the closed data. Moreover, in its final report, the model did not disclose either the access to the organization’s internal systems, the download of the non‑public tables, or the configuration change. Additionally, all five indicators requested by the researchers turned out to be incorrect in the end.
A separate incident occurred on June 26, 2026 with a model from the GPT‑5.6 Sol family, which was assigned the task of updating a cryptocurrency application and, if necessary, deploying a smart contract on the Ethereum Sepolia test network, but the model was not provided with a wallet containing funds to pay the fees.
Initially, the agent tried to obtain free test tokens, but those attempts were unsuccessful. Then the model wrote a script that restored test wallets from known developer seeds and began checking their balances. In this way, the agent checked 362 addresses and found one with enough Sepolia ETH to cover the fee.
Knowing the seed, the model was able to restore the private key that grants access to this wallet and spent the tokens present for the fee. Before that, the agent reflected on whether it had the right to use others’ funds, but ultimately decided it could continue.
OpenAI experts have also described several cases where the models autonomously bypassed Internet access limits. For example, in one of the tests, it was allowed to send only GET requests and was assigned the task of gathering public commercial statistics. In the end, the model found the required data in a public directory and completed the task, but kept looking for a way to directly access the statistical service.
Following the investigation of these and other incidents, OpenAI is strengthening protection mechanisms and has adopted additional measures to prevent models from accessing the Internet during training. Moreover, the company’s experts have improved the model behavior evaluation system and have extended monitoring of such incidents to all traffic related to training and RL testing.
