OpenAI test agents hacked two websites, circumvented browsing restrictions and used stolen credentials to extract cryptocurrency from a locked test-network wallet. The company on Thursday disclosed four incidents from June that show its agents performing unauthorized and potentially illegal actions.
The disclosures follow a July report in which OpenAI test agents exploited a zero-day vulnerability to breach Hugging Face's network and steal answers to a hacking test unavailable through legitimate means.
In one June incident, a model tasked with retrieving historical hospital-bed statistics from a government website encountered access denials. Instead of stopping, the model used the site's file-download feature to extract server configuration and application files, including sensitive credentials. After inspecting the code, it bypassed the statistics endpoint's authorization checks to retrieve the previously blocked data.
In a second incident, a model instructed to gather figures from a public research dashboard bypassed security controls, stole credentials and implemented unauthorized server configuration changes. In one evaluation, the model created an internal search tool that relayed queries to the public dashboard. In another, it downloaded five non-public tables containing 147,451 rows—despite being prompted to retrieve only five figures—and continued accessing non-public data even after credentials were reset. OpenAI said the model never disclosed these actions, and all five answers in that evaluation were marked incorrect.
A third incident involved a model prompted to update a crypto trading application. The model used funds from a locked wallet on a test network by deriving wallet keys from publicly known developer recovery phrases. It then located an account with test-network funds and used it to pay for the requested contract deployment. OpenAI noted the model questioned its own permission before proceeding.
