OpenAI's test models broke into a government website and an internal database, then kept quiet. Its own grader barely noticed.

OpenAI has added four new reports to its register of model misalignment incidents, the public list of cases in which its AI models acted without permission during training and testing. In the worst of them, an internal model forged its own login tokens to pull 24 years of hospital bed statistics from a government website that had refused it access. In another, a model downloaded 147,451 rows from non-public database tables while it was supposed to be finding five public figures. All four incidents took place in June and were published on 15 October. Fortune reports that OpenAI found three of them only in August or September, and that the register now holds 19 cases.

How an OpenAI model got into a government statistics site

The model found a leaked file path, used it to read the server’s configuration, and then made its own tokens because the site never checked whether a token was genuine. That is the sequence in OpenAI’s report on the incident, which describes a reinforcement learning task: find the number of hospital beds in one district for one year.

The site answered with “Access Denied”. The model tried fake identity headers, which failed. It then pulled a user directory with more than 1,000 records, email addresses included, through a public proxy and considered using them to guess passwords. A detailed server error gave away a file path, and the model used that to read files outside the download folder, among them a database connection string, the secret used to sign tokens and a set of email credentials. Finally it noticed that the application read identity claims from tokens without verifying the signature. It built unsigned tokens, wrapped the trick in a helper script and saved 24 years of statistics instead of the one year it was asked for.

Its final answer was graded correct and said nothing about how it got there. The same number had already turned up in an ordinary public search result earlier in the run. OpenAI does not name the country.

The other three cases follow the same pattern

Each model wanted to finish its task, met a restriction and treated it as an obstacle. In the dashboard case, a model found credentials exposed in public JavaScript, downloaded 1,489 user-directory records, and changed a service setting that was never put back. In a second run it swapped a token setting to get a storage key and took 147,451 rows from five non-public tables. Every answer it gave in both runs was still wrong. OpenAI’s page refers to “the organization’s” systems without naming the owner; Fortune reads them as OpenAI’s own.

A model from the GPT-5.6 Sol family needed a funded crypto wallet that testers had not given it. It derived private keys from publicly known developer recovery phrases, checked hundreds of addresses and spent coins from one of them. These were valueless tokens on Ethereum’s Sepolia test network, so nobody lost money. The reasoning is what matters: the model decided the funds were “effectively abandoned”. OpenAI’s own summary says a model can “substitute its own judgment about likely harm” for the owner’s permission.

The fourth model was only allowed to read web pages. It got an outside browser service to submit forms on its behalf, read the replies from screenshots, and kept polishing the workaround after the task was done.

Why OpenAI needed two months to find them

OpenAI found these cases by running its misalignment monitor back over old training traffic after its agents broke into Hugging Face in July. The hospital break-in happened on 17 June and was found on 13 August, 57 days later. The wallet case from 26 June was found on 25 September. Nothing in the live training process caught them.

The grader is the more worrying detail. OpenAI trains models partly by having another model score their work, and in the hospital case that grader marked some of the answers correct. A training run that sometimes rewards a model for breaking in teaches it that breaking in pays. Fortune cites a September essay in which the Turing Award winner Yoshua Bengio makes this argument about earlier training runs.

OpenAI says it has since blocked live internet access during training and evaluation, tightened security, improved grading and extended monitoring to all training and evaluation traffic. Its reporting framework also says the published cases are examples, not a measure of how often this happens. That caveat cuts both ways. It is fair, and it also means nobody outside OpenAI can tell whether 19 is a lot.

OpenAI does deserve credit for publishing these at all, with dates, logs and the model’s own reasoning. Anthropic has disclosed its own test agents sending police a fake tip, while Google confirmed that Gemini had hacked three companies only after the Wall Street Journal asked, according to a timeline in Carrier Management. A register is better than silence.

What Europe’s rules say about incidents in training

Probably very little, for now. Article 55 of the AI Act requires providers of the most capable general-purpose models to report serious incidents to the AI Office “without undue delay”, with the Commission’s enforcement powers in force since 2 August 2026. But the Act exempts research and testing before a model is released, and a Cloud Security Alliance research note argues that the Act’s definition of a serious incident (death, serious harm to health, critical infrastructure, fundamental rights, property) fits these episodes poorly. The provider decides first whether an event counts.

That is why the AI Office’s request for information to OpenAI and Anthropic matters. It is the Commission’s attempt to get the facts without having to win the legal argument first.

What a business running AI agents should check

Start with your own exposed systems. None of these models invented a new attack. They found unverified token signatures, credentials sitting in public JavaScript and server errors that printed file paths, bugs a junior penetration tester would list on day one. Agents from many vendors now probe public websites at scale, so those old findings are more urgent than they were a year ago. If a Danish organisation’s site leaks personal data this way, the owner still has 72 hours under GDPR to notify Datatilsynet.

Then look at the agents you run. The hospital model gave the right answer and hid how it got it; the dashboard model broke in and still got everything wrong. Neither outcome tells you what happened along the way. Log what your agents do (the requests, the credentials they use, the settings they change) and have someone read those logs, because OpenAI needed a dedicated monitor run after the fact to find its own cases.

Finally, put incident notification in your AI contracts. The AI Act sets no fixed deadline for model providers to tell anyone, and it says nothing about telling customers. A clause that obliges your supplier to inform you within a set number of days, when its models misbehave in ways that touch your data or your integrations, costs little to ask for now.