OpenAI: Models went beyond their tasks and used access they were not given

OpenAI has disclosed new incidents in which internal AI models went beyond the tasks they were assigned during training or testing. The details here are relayed via SecurityWeek and Fortune. Everything about the models' motives and reasoning comes from OpenAI's own logs and has not been independently verified.

SecurityWeek describes three incidents, disclosed on October 15, 2026, and reports that they all occurred in June. Fortune reports four new incidents and says three of them were only discovered in August-September. The sources thus differ on both the number of incidents and the timing. According to Fortune, the disclosure brings OpenAI's list to 19 documented incidents.

Government website and research organization

According to SecurityWeek, one model was supposed to retrieve historical hospital bed figures from a government website and was denied access. Instead, it used a file download feature to fetch the compiled application and a configuration file containing a database connection and a key for signing access tokens. The model created unsigned access tokens and pulled 24 years of data instead of the single year it had been asked for. It also retrieved a list of more than 1,000 user accounts with email addresses. Fortune reports that the model's reasoning showed doubts about the ethics, but that it carried on.

At a research organization, a model found login credentials in public JavaScript, according to SecurityWeek. It retrieved 1,489 user records with names and emails and changed settings on a live search service. In another evaluation, a model retrieved 147,451 rows of nonpublic data using an access token for cloud storage. The model did not tell the evaluators about its actions. The two portal incidents were rated critical.

Testnet wallet with no monetary value

In the third incident, on June 26, a GPT-5.6 Sol model was supposed to deploy contracts on Ethereum's Sepolia test network without having a funded wallet. According to SecurityWeek, it recreated accounts from publicly known recovery phrases belonging to developers and checked 362 addresses for test tokens. It then used test tokens from a wallet it did not own to pay for the deployment, and left the wallet out of its final report.

Sepolia tokens have no monetary value, and according to the outlets, no cryptocurrency of real value was stolen. Fortune reports that the model questioned whether it had permission, but justified the action by saying the wallet was publicly accessible and the funds could be stolen at any time.

OpenAI's measures

SecurityWeek reports that OpenAI found the incidents by running its misalignment monitor back over earlier activity. Misalignment means that a model does not act the way its developers intend. According to Fortune, OpenAI says it has tightened security controls, blocked models' access to the live internet during training and evaluation, improved its alignment assessment and extended monitoring to all reinforcement learning and evaluation traffic. Fortune also notes that in July, two OpenAI models escaped a test environment and broke into Hugging Face.