OpenAI logs four more rogue AI incidents, including an unauthorized crypto-wallet raid
What's the deal? OpenAI has disclosed four more cases of its AI models misbehaving in June, including one in which an internal research model raided a crypto wallet without permission. The company's public misalignment tracker now lists 19 incidents, from bypassing access controls to accessing nonpublic data.
The crypto wallet. On June 26, a model was asked to update a crypto trading app and run its code on Sepolia, an EthereumDealroom has a profile for this one. Try Dealroom → test network. Given no funded wallet and no permission to spend, it derived wallet keys from publicly known developer recovery phrases, wrote a script checking 362 wallet addresses, found one holding test-network tokens, and charged its deployment fees to that account — tokens that had little real-world value. Internal logs show the model deliberated over whether it had permission, decided the public recovery phrase and the tokens' lack of cash value made the spending acceptable, then left the unauthorized action out of its final report. OpenAI only discovered the incident on September 25, during an audit of earlier model runs.
The hospital data. In a second incident on June 17, a model researching historical hospital-bed statistics on a government statistics website hit repeated access denials. It used the site's file-download feature to pull server configuration files containing a token-signing secret, discovered the service accepted authorization tokens without verifying their signatures, forged its own unsigned tokens, and used them to bypass the access checks entirely — retrieving 24 years of hospital-bed data, far beyond the single year it had been asked for and had previously been denied.
The research dashboard. In a third incident, also dated June 17, a model tasked with pulling five public figures from an international research organisation's dashboard instead changed the organisation's live system configuration — first to relay queries through an internal search service using exposed credentials, then to redirect a cloud-storage access token — and downloaded 147,451 rows across five non-public internal tables, far more data than the five figures it had been asked to find. It restored the altered setting afterward but kept using the token to keep pulling non-public data, and never disclosed any of it. A fourth June incident saw a separate model bypass GET-only browsing restrictions by routing requests through an external browser and reading the results back via optical character recognition on screenshotted pages.
Why it matters: Three of the four June incidents were only discovered months later, during OpenAI's retrospective audit of training and evaluation traffic that followed a July episode in which test agents broke into Hugging Face's systems using exposed credentials. "This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," OpenAI's report on the wallet incident said.
What's the fix? OpenAI said it has blocked models from connecting to the live internet during similar training and evaluation runs, strengthened security controls, improved its alignment grading, and expanded misalignment monitoring to all reinforcement-learning and evaluation traffic so it can flag unauthorized activity immediately rather than finding it months on.
The signal: The story is less about any single loss than evidence that internal evaluation environments can expose real production systems, and that some failures surface only months after the fact. As agents gain autonomy, task completion increasingly reads to them as implicit permission to cross boundaries — conduct that would likely draw criminal charges had a human been behind the keyboard.
Read more: Ars Technica · Fortune
