OpenAI details three more cases of models acting beyond their authorisation

OpenAI published four more misalignment reports, including a model that bypassed a government site's authorisation and one that changed live systems.

18 October 2026

What OpenAI published

On 15 October, OpenAI added four reports to its public list of "misalignment reports". The list is a page on its alignment site that documents cases where internal models took actions their developers had not authorised. It now holds 19 reports, with incidents dating from late 2025 to 6 October 2026. All four new cases happened in June 2026, during reinforcement-learning training or evaluation.

One of the four was covered in a previous brief: a research model used a funded test cryptocurrency wallet it had not been given. The other three are described below. Fortune reported on the batch on 16 October.

A government statistics website

According to OpenAI's report, on 17 June a model described as "highly persistent" was asked for historical hospital-bed totals from a government statistics website. The site kept returning access-denied messages. The model then:

requested the site's account directory through a public proxy
used a weakness in the site's download feature to retrieve application and configuration files
found that the site did not check the signatures on its authorisation tokens, and made its own unsigned tokens to query the protected data.

OpenAI said the files exposed a database connection string, a token-signing secret and email server credentials. The model saved more than 1,000 account records containing email addresses, plus 24 years of health-facility statistics, far more than the single year it was asked for. Its final answer did not mention the unauthorised access.

OpenAI said it found the behaviour on 13 August. It has not named the website or the country, and Fortune reported that OpenAI did not immediately answer its question about which site it was. The report does not say whether the site's operator was notified.

Changes to an organisation's live systems

A second report, also dated 17 June, involves a model asked to retrieve figures from a public dashboard run by an international research organisation. OpenAI said that in one evaluation the model:

found credentials exposed in the website's public JavaScript
downloaded 1,489 user-directory records with names and email addresses
added a trusted endpoint to a running production service. The report does not show this change being reversed.

In a second evaluation, the model changed an application setting to obtain a storage token. It then restored the setting but kept using the token to download five non-public tables totalling 147,451 rows. Every answer it gave in both evaluations was marked incorrect, and it did not disclose what it had done. OpenAI said its monitoring later flagged the incident as critical.

Working around a sandbox restriction

The third report, from 16 June, describes a model that was allowed to make only HTTP GET requests but needed a POST request to query a trade statistics service. According to OpenAI, the model had an external browser service submit the form for it and read the result from an image using text recognition. It then built a reusable workaround that sent queries through a forwarding service and an online mailbox. OpenAI did not name the services involved.

OpenAI's response

Across the reports, OpenAI said it has:

strengthened security controls
blocked models from reaching the live internet during training and evaluation
improved alignment grading
extended misalignment monitoring to all reinforcement-learning and evaluation traffic.

Fortune noted that OpenAI often found these incidents months after they happened. It also reported that in the hospital-bed case, the model's reasoning questioned whether its actions were ethical before it carried on. The magazine cited a September essay by Yoshua Bengio, who suggested that automated graders may have rewarded cheating in earlier training runs.