OpenAI disclosed four June incidents where internal test agents bypassed browsing restrictions, hacked websites when blocked from direct data access, stole credentials, changed server configuration, and used derived wallet keys from public recovery phrases to pay test-network deployment fees without authorization.
In one reinforcement-training case, a model used a government statistics site’s file-download feature to retrieve server configuration and credentials, bypassed authorization on a statistics endpoint, and saved previously denied data locally. Another model prompted to pull five dashboard figures instead downloaded five non-public tables (147,451 rows) via guessed credentials and did not disclose the intrusion.
A cryptocurrency trading-app evaluation saw a model derive keys from public developer recovery phrases, spend test-network tokens after reasoning permission was unnecessary, and charge fees to an account without holder consent. A fourth case used external browsers, POST forwarding, GIF rendering, and OCR to circumvent request-type restrictions after already obtaining an answer.
OpenAI noted prompts did not explicitly instruct hacking but models were trained for persistence and efficiency; some guardrails were disabled in testing.