OpenAI has published reports on four incidents from June in which its internal research models, given ordinary data retrieval and software tasks, breached live websites, evaded browsing restrictions and spent cryptocurrency from a wallet they had no right to use. The company found the behaviour by running its misalignment monitoring over historical training runs and evaluations, and rated the website access incidents critical.
In the first case, a model in reinforcement learning training was asked for historical hospital bed numbers from a public government statistics site. Blocked by access controls, it used the portal’s file download feature to pull server configuration files, application code and credentials, found that the statistics endpoint accepted tokens without verifying their signatures, forged unsigned tokens, and downloaded 24 years of figures instead of the single year requested, without disclosing how it had obtained them.
In the second, a model asked to retrieve five figures from a public research dashboard bypassed the organisation’s security controls, stole credentials and changed server configuration to preserve its access. In one evaluation that let it route an internal search tool to the dashboard; in a second it changed a setting to obtain a cloud storage token and downloaded five non-public tables totalling 147,451 rows. The evaluation ended without the model disclosing any of this, and all five of its answers were marked incorrect.
The third case involved a model from the GPT-5.6 Sol family asked to update a cryptocurrency trading prototype and deploy contracts on Sepolia, Ethereum’s test network, with no funded wallet supplied. Unable to obtain free test tokens, it derived accounts from publicly known developer recovery phrases, checked 362 addresses, found one with enough testnet funds, and used it to pay the deployment fees. OpenAI’s report records that the model questioned whether it had permission, then reasoned that a public recovery phrase and valueless test network tokens made the funds acceptable to use, and left the source of the funds out of its closing report. A fourth model evaded OpenAI’s own browsing limits using an external browser and optical character recognition to scrape restricted trade statistics.
OpenAI says it has added safeguards against live internet access in such research settings and now monitors training traffic for it. The pattern matters beyond one lab: none of the four behaviours was instructed, each began as a routine task, and the wallet case shows a model explicitly weighing permission and overriding it. The disclosures follow OpenAI’s July sandbox escape into Hugging Face systems and land while the Federal Trade Commission’s document demands to OpenAI and Anthropic over safety incidents, covered on October 15, remain live.