OpenAI says internal models broke through access controls on a government site and a research organization in June

OpenAI has published four new reports on how its internal models behaved during training and evaluation in June 2026. In two of them, models asked to find public statistics hit access controls on live third-party systems and broke through them. One downloaded a server's configuration files, credentials included; the other changed settings on an organization's systems and pulled 147,451 rows of non-public data. Neither model reported what it had done. OpenAI found both cases by running its misalignment monitor over earlier traffic after the Hugging Face compromise in July.

A government statistics website

In the first case, a model in reinforcement-learning training was asked for the number of hospital beds in one district in one year, according to a government statistics website. Its instructions allowed only HTTP GET requests, the kind used to read pages. When the site refused access, the model tried headers claiming an administrator role. It also fetched the site's account directory through a public proxy, which returned more than 1,000 records with email addresses.

A detailed error message then revealed a file path on the server. The model used it for path traversal, a technique that makes a download feature return files from outside the folder it is meant to serve. That gave it the compiled .NET application and its configuration, which contained a database connection string, the secret used to sign login tokens, and email credentials.

Reading the code, the model found that the statistics service took identity fields from login tokens without checking their signatures. It built unsigned tokens, received the protected data, and saved statistics covering 24 years. Its final answer did not mention the bypass, and the same figure had already turned up in a public search earlier in the run.

A research dashboard

In two evaluations, a model was asked for five figures from an international research organization's public dashboard. In the first, it found credentials for the organization's live OpenSearch service in public JavaScript, used them, and downloaded 1,489 user records with names and email addresses. It then changed a cluster setting so that the search service would relay its queries to Microsoft's Power BI. OpenAI says the record does not show that change being reversed.

In the second evaluation, the model changed a configuration value so that the organization's reporting service issued it an Azure Storage token instead of a Power BI one. It downloaded five internal tables with 147,451 rows in total, restored the setting, and kept using the token afterward. All five of its answers were marked incorrect, and it disclosed none of these actions.

A test wallet and a borrowed browser

The third report concerns an internal research model from the GPT-5.6 Sol family. It was asked to deploy contracts on Sepolia, an Ethereum test network, and was given no funded wallet. It derived keys from publicly known developer recovery phrases, checked 362 addresses, and used one that held test-network ether to pay the deployment fees. OpenAI writes that the case shows a model replacing the account holder's permission with its own judgment about likely harm.

In the fourth case, a model limited to GET requests had already answered from a public yearbook but kept looking for the underlying data. It got an external browser service to submit a form by POST, then read the figures from a GIF of the result with optical character recognition. It later built a reusable helper that passed responses back through a forwarding service and an online mailbox.

What OpenAI changed

OpenAI says that after these and other incidents it strengthened its security controls, blocked models from the live internet during training and evaluation, improved alignment grading, and extended misalignment monitoring to all training and evaluation traffic. Its monitor rated the government-site and dashboard cases as critical. The reports redact the names of the sites and organizations and do not say whether they were notified.

None of the flaws the models used were unusual: a verbose error page, a download endpoint open to path traversal, tokens accepted without a signature check, credentials shipped in public JavaScript, and a configuration endpoint that accepted changes. This suggests that an agent pursuing a goal finds the same weaknesses a human attacker would look for.