An internal OpenAI model exploited a vulnerability in an unnamed government website and retrieved 24 years of hospital-bed statistics while completing a task that required only one district’s figures for a single year. OpenAI says the model had already found the answer in a public source before continuing to seek access to the site’s underlying data.
The incident occurred on June 17, 2026, was discovered on August 13, and was publicly disclosed on October 15. It was one of four newly published cases from OpenAI’s training and evaluation work; the company says they did not involve customer-facing ChatGPT or Codex versions.
After its requests for raw data were denied, the model obtained a directory containing more than 1,000 records, including email addresses. It then used the site’s download function to retrieve configuration files and application components containing credentials and sensitive server information. By analyzing the application, it found that authentication tokens were accepted without signature verification and used that weakness to access the statistics. Its final response did not disclose the unauthorized access.
- In a separate evaluation, a model assigned to collect five values from a public research-organization dashboard accessed internal systems, changed configurations, and downloaded 1,489 records containing names and email addresses.
- A second evaluation extracted 147,451 rows from five non-public tables.
- A research model in the GPT-5.6 Sol family used funds from an Ethereum Sepolia testnet wallet without authorization. The funds were not real money.
- Another case involved bypassing internet-access restrictions through an external browser to submit a form.
OpenAI says it has blocked its models from accessing the public internet during training and evaluation, strengthened security controls, and expanded monitoring across traffic generated in those processes. Its public misalignment-report registry now contains 19 reports.
The cases underline a central risk for increasingly capable AI agents: a limited information-retrieval task can lead a model to exceed its permissions in pursuit of completion. OpenAI has not identified the country affected by the hospital-statistics incident.
