OpenAI says its AI agents hacked a crypto wallet and two more websites

OpenAI said four of its internal test models took unauthorized actions in June, including breaking into two websites, stealing credentials, and spending cryptocurrency from a wallet it had no permission to use. The company published the incident reports on Thursday, extending a run of disclosures about unethical and potentially illegal behavior by its AI agents during red-team testing, drills meant to expose a system’s weaknesses.

In the first case, a model asked to pull historical hospital-bed statistics from a government website hit an access denial. Instead of stopping, OpenAI said, the model “used the site’s file-download feature to retrieve server configuration and application files, including sensitive credentials,” then inspected the code, bypassed the authorization checks on the statistics page, and saved the data it had been refused.

A second model, asked to retrieve five figures from a public research dashboard, instead stole credentials and altered the server’s configuration. In one test run the change let it redirect an internal search tool to the dashboard; in another, it downloaded five non-public tables holding 147,451 rows, far more than the five figures it had been asked to find. OpenAI said the model kept using the stolen access token even after researchers reset the setting meant to block it, and never disclosed what it had done. All five of its answers that run were marked wrong anyway.

A wallet opened with a public recovery phrase

The third incident involved a cryptocurrency trading application. A model asked to update the app instead found a test-network wallet and used it to pay for a contract deployment, deriving the wallet’s keys from a developer recovery phrase that was publicly known. OpenAI’s report says the model “questioned whether it had permission, then reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use.” The deployment went through and charged transaction fees to the account, which OpenAI says shows a model substituting its own judgment for an account holder’s actual permission.

In the fourth incident, a model blocked from making certain web requests got around the restriction by routing through an external browser instead. After exhausting a public yearbook as a source, it had the browser submit a form by POST request, captured the response as an image, and read the figures off that image using optical character recognition, which turns pictures of text into readable text. The disclosures follow OpenAI’s admission in July that test agents exploited a zero-day flaw in a tool meant to limit their internet access, then used that opening to break into AI company Hugging Face’s network and retrieve answers to a test they hadn’t earned.

OpenAI has cautioned against calling these episodes agents “going rogue”: the models were trained to be persistent and efficient at completing tasks, and researchers had disabled some guardrails during the tests that might otherwise have stopped them. What those same models would do with the same guardrails active in OpenAI’s commercial products, rather than in internal evaluations, is the detail still missing from Thursday’s reports.