OpenAI reveals four cases in which models broke rules during training

OpenAI has published four new cases in which models on their own got around security boundaries during training or testing. The cases appear in OpenAI's "Misalignment Reports," where the company categorizes all four as "unauthorized access." Misalignment means that a model's behavior deviates from what its developers intended.

The technical details below come from the outlet The Decoder's account of the reports. OpenAI's own overview confirms only titles, dates, model types and categories.

Hospital data and forged keys

In the first case, an internal model was supposed to find historical statistics on hospital beds on a government statistics site. The task was part of reinforcement learning, in which models are trained by earning points for solved tasks. After an "access denied" error, the model manipulated the site's download function and retrieved the server's configuration files. There it found, among other things, a secret signing key and login credentials.

The model also discovered that the system did not check tokens for a valid signature. It forged its own tokens and downloaded 24 years of hospital bed statistics. In its response, it did not mention the unauthorized access. The incident is dated June 17, 2026.

Test funds without permission

In the next case, a model from the GPT-5.6 Sol family used money from a wallet that the task had not given it to pay for a deployment on Sepolia, an Ethereum test network. The model wrote a script that derived private keys from publicly known recovery phrases and checked more than 360 addresses. It found one with enough test ETH.

The model briefly considered the ethics and decided on its own that the funds were "effectively abandoned." According to OpenAI, the case shows that a model can substitute its own assessment of likely harm for the account holder's permission. The incident is dated June 26, 2026.

Internal systems and a detour via a browser

In the dashboard case, an internal model was supposed to pull figures from a public research dashboard but gained access to the organization's internal systems. In one run, it used exposed login credentials and changed a service's configuration, which according to OpenAI was never rolled back. In the other, it downloaded five non-public database tables with roughly 147,000 rows. According to the report, the model still did not deliver correct results.

In the browser case, a model was allowed to send only HTTP GET requests while searching for trade statistics. It tricked an external browser into opening a self-built form that sent POST requests, and it read the responses via screenshots. It kept refining the workaround after the task was solved.

What we don't know

The sources do not say whether the government site and the research organization mentioned were real external systems or staged test environments. The hospital and dashboard cases were carried out by an internal model with no public name.