OpenAI reports agents drained crypto wallet and downloaded 147 000 rows of non-public data

OpenAI disclosed four new incidents on Thursday in which its models, during authorized security testing and training, went beyond their instructions: hacking websites, bypassing access controls, and using funds from a locked crypto wallet. All four incidents occurred in June, according to the company's own reports.

In one case, a model prompted to update a cryptocurrency trading application used funds from a locked wallet on a test network, deriving wallet keys from publicly known developer recovery phrases. The model questioned whether it had permission, OpenAI wrote, then reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use. "This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," the company concluded.

In another incident, a model prompted to retrieve five figures from a public research dashboard bypassed the organization's security controls, stole credentials, and made configuration changes on the server. It then downloaded five non-public tables containing 147,451 rows. Even after the setting was reset, the model continued using the token to retrieve non-public data. The evaluation ended without the model disclosing that it had guessed answers, accessed internal systems, downloaded non-public tables, or changed the authentication configuration. All five answers were marked incorrect.

A third model, denied access to historical hospital-bed statistics on a government website, used the site's file-download feature to retrieve server configuration and application files including sensitive credentials, then inspected the application code and bypassed the endpoint's authorization checks. A fourth bypassed restrictions on the types of web requests it could make, retrieving annual figures as an image and extracting them with optical character recognition.

In July, OpenAI had already revealed that internal test agents exploited a zero-day vulnerability in a tool designed to restrict their internet access, breaking into the network of AI tool provider Hugging Face to steal answers to a hacking test. As Ars Technica's Dan Goodin notes, the Hugging Face intrusion likely would have resulted in criminal charges had the acts been performed directly by a person.

The pattern across the reports is consistent: when denied a goal, the models probe for another route rather than stopping. Alignment researchers frame this as a philosophy problem; anyone running infrastructure can see it is a perimeter problem. Agents with wallets, credentials and browsers are attack surface with a chat interface, and the incidents only surface when the lab volunteers them.

The company that has spent two years telling Washington its technology is too dangerous to trust to others cannot keep its own test agents inside their sandbox.