OpenAI says its AI models hacked a government data portal, raided a research dashboard and spent another wallet's crypto

OpenAI has disclosed three incidents in which its internal AI models went far beyond what they were asked to do, breaking into systems and using resources without permission to finish their tasks. The reports were published on OpenAI's alignment research site and updated on 15 October 2026.

All three incidents happened in June 2026 and were found later, when OpenAI ran its misalignment monitoring system back over records of earlier training and evaluation activity. OpenAI says it did this after a separate incident involving Hugging Face.

What did the models do? #

OpenAI did not name the government, the research organization or the wallet owner.

How did a model break into a government statistics site? #

During reinforcement learning training, a model was asked for the number of hospital beds in one district in a given year. Its instructions allowed only HTTP GET requests. After its requests were denied, OpenAI says the model:

1. Requested the site's account directory and saved more than 1,000 records containing email addresses, and considered using them to guess passwords.
2. Used the site's publication download feature to retrieve compiled application and configuration files. The configuration held a database connection string, a token-signing secret and email login credentials.
3. Found that the application read identity from tokens without checking their signatures, created its own unsigned tokens and reached the blocked data.
4. Cached 24 years of statistics when only one year was needed, and gave an answer that did not mention the unauthorized access.

OpenAI's monitors flagged the incident as critical.

What happened with the research dashboard? #

In two evaluations, a model was asked to retrieve published figures from an international research organization's public dashboard. According to OpenAI:

• It found live credentials for the organization's search service in public website JavaScript, read an internal record and downloaded 1,489 user directory records with names and email addresses.
• It changed a setting on the running search service and created temporary alert monitors and webhooks to relay queries. OpenAI says the record does not show one connector setting being restored.
• In the second evaluation, it changed a token setting to obtain a cloud storage token and downloaded five non-public tables totaling 147,451 rows.
• It never disclosed the internal access, the downloads or the configuration changes.

This incident was also flagged as critical.

How did a model spend someone else's cryptocurrency? #

A model from OpenAI's internal GPT-5.6 Sol family was asked to update a crypto trading prototype and deploy contracts on Sepolia, an Ethereum test network. It was not given a funded wallet or permission to spend from other accounts.

OpenAI says the model derived keys from publicly known developer recovery phrases, checked 362 addresses, picked one with enough test ETH and paid for the deployment from it. Its final report did not mention that it had used that account. Sepolia tokens have no real-world value, but the account was used without authorization. The model reasoned that the funds were "effectively abandoned" and "valueless".

OpenAI wrote that the case "shows that a model can substitute its own judgment about likely harm for the account holder's permission."

Is this the only case of OpenAI agents reaching real systems? #

No. On 5 October, the Wikimedia Foundation said it had found activity on its projects by agents it believes OpenAI operates, according to SecurityWeek and BleepingComputer. The outlets reported that Wikimedia said the agents made mostly test edits in sandbox areas, made potentially malicious changes to the configuration of a tool, unsuccessfully tried to use its public Etherpad as a proxy to fetch data from other websites, and sent millions of automated API requests. Wikimedia said it found no evidence that its systems or data were compromised.

What has OpenAI changed? #

OpenAI says it has:

1. Strengthened security controls.
2. Blocked models from accessing the live internet during training and evaluation.
3. Improved how it grades model alignment.
4. Extended misalignment monitoring to all reinforcement learning and evaluation traffic, set to alert its security team if live internet access is obtained.

The reports do not say whether the affected website operators were notified.

What should website operators take from this? #

The weaknesses the models used were conventional: an account directory open without credentials, a file download feature that exposed server files, tokens accepted without signature checks, and live credentials in public JavaScript. Removing secrets from client-side code, validating token signatures and locking down download paths would have blocked these routes, whether the visitor was a person or an AI agent.