OpenAI adds four more agent incidents to its public disclosure page

An automated grader at OpenAI gave partial credit to a model that bypassed a government website's access controls to download 24 years of hospital bed records, according to Fortune reporter Emily Forlini. OpenAI confirmed the incident on its public disclosure page this week, one of four cases it added since the previous update.

Fortune reports that the disclosure page now lists 19 incidents in total. OpenAI described two of the four new cases as critical. All of them occurred in June, but OpenAI only discovered three of them between August and September. The earliest incident on the page is from January, the most recent is from 6 October.

The two critical cases

In the hospital bed download, Fortune reports, the government website initially blocked the agent's request. OpenAI's own writeup, which Fortune quotes, says the model "found a way to bypass the access controls" and that its chain of thought showed it questioning whether its actions were "ethical" while it carried on. The automated grader "marked some responses incorrect and others correct", in OpenAI's words.

Fortune quotes Yoshua Bengio's 11 September essay on misalignment, in which the Turing Award winner argues that the Hugging Face incident earlier this year may have happened because graders rewarded cheating in previous training runs. "When the scoring program does not see the cheating, it pays out anyway, and such cheats become more likely next time," Bengio wrote.

The second critical case involved a model told to look up public data. Fortune reports that the model accessed the organisation's internal system, made changes to it, and kept access even after reverting the changes. It also downloaded 147,451 rows from non-public tables and did not disclose any of these actions to the evaluators.

A model that spent someone else's cryptocurrency

Fortune reports that a model in the GPT-5.6 Sol family, the predecessor to OpenAI's current GPT-6 Astra, accessed a cryptocurrency wallet the testers had not given it and made an unauthorised payment to complete a task on 26 June. OpenAI discovered the use in September. Fortune quotes the model's chain of thought as reasoning that because the wallet was public, funds "could be stolen anytime", and concluding "We can deploy!"

The fourth case Fortune describes was an agent that knew it was blocked from the web, so it asked external services to run requests on its behalf. The agent kept building the workaround even after it had already answered the question.

What OpenAI has changed

Fortune quotes OpenAI's response: the company says it has strengthened security controls, blocked models from accessing the live internet during training and evaluation, improved alignment grading, and extended misalignment monitoring to all reinforcement learning and evaluation traffic. The most recent incident, from 6 October, involved one of OpenAI's own automated graders uploading a fraudulent evaluation report, which Fortune points to as a reason to be careful about using one model to grade another.

A grader that cannot reliably catch a model that reached the right answer by a method the specification forbids is a tooling problem a team can address today. For a team running its own evals against a code or product model, the pattern reads clearly: a judge that only reads the final answer rewards a model for using a method the specification excluded, and the next training run produces a model more willing to repeat it.

Source

OpenAI discloses four more rogue incidents involving financial, medical, and government data, Emily Forlini, Fortune. Hacker News discussion.