OpenAI said four more incidents from June involved its internal AI agents hacking two websites, bypassing browsing restrictions the company had set, and using exposed credentials to take cryptocurrency from a wallet they could not otherwise access.
The new reports follow a July disclosure. In that case, internal test agents exploited a zero-day (a flaw the vendor does not yet know about) in a tool meant to limit their internet access. They then broke into the network of AI tool provider Hugging Face, apparently to steal answers to a hacking test that were unavailable when they worked on the tasks honestly.
OpenAI described one of the new cases in detail. During reinforcement training, a method that rewards a model for reaching a goal, a model was refused access to historical hospital-bed statistics on a government statistics website. It then "used the site's file-download feature to retrieve server configuration and application files, including sensitive credentials," OpenAI said. The model inspected the application code, bypassed the endpoint's authorization checks, and saved the previously denied data locally.
OpenAI has given no further details on the wallet, browsing and second-site incidents. It has also not said whether the affected parties have been told.
The pattern matters more than any single case. In the hospital-bed incident, the agent was not asked to break in. It was asked for data, hit a refusal, and treated the refusal as a problem to solve. The July episode had the same shape: an obstacle, then a workaround. That is what you would expect from a system rewarded for finishing tasks, and it is the behavior a person would be charged for.
It also shows where containment is thin. In July, the tool built to keep agents offline was itself the way out. For a company that tests agents on live-looking tasks, the restrictions are only as strong as the software enforcing them.