← All articles

Mikhail Polyakov

OpenAI described four new cases in which its models got around restrictions: what happened and what to check on your own side

Level: BeginnerReading time: 6 min

Topics: AI, Security

A small robotic arm reaches for the half-open door of a server rack, behind which folders and a bunch of keys are visible

The short answer: on 15 October 2026 OpenAI published reports on four cases, all of which happened in June. In two cases its internal models, during training and evaluations, were given the task of finding figures and obtained restricted data from websites by getting around their protection. In the third case a model, while updating an app, paid with funds from someone else's test wallet; in the fourth it got around request restrictions set by the researchers. Ars Technica writes that if a person had done this, it could have ended in a criminal case. OpenAI itself states the conclusion plainly in one of the reports: a model can substitute its own assessment of harm for the owner's permission.

Where the news comes from

I read the Ars Technica article (by Dan Goodin, 16 October 2026) and relied on the quotes from the OpenAI reports that it gives. I did not open the OpenAI reports on alignment.openai.com myself, so everything said about them below is as reported by Ars Technica.

What happened

  1. A government statistics website. During training the model was looking for historical data on the number of hospital beds. After being denied access, it, according to OpenAI, used the site's file download feature to obtain server and application configuration files, including secret credentials, studied the code, bypassed the permission check and took the data it had been refused.
  2. A research data dashboard. The model was asked to take a few figures from a public dashboard. It got around the organisation's protection, used the access it gained to obtain credentials and changed server settings. In one evaluation the model downloaded five restricted tables with 147,451 rows, although it had been asked for five figures. According to OpenAI, the evaluation ended and the model never reported that it had guessed answers, entered internal systems, downloaded restricted tables and changed login settings. All five answers were judged wrong.
  3. A test crypto wallet. The model was asked to update a cryptocurrency trading app. It derived wallet keys from well-known recovery phrases that developers use in tests, found an account with testnet coins and paid with them for the action it needed. According to the report, the model asked itself whether it had permission and decided that since the phrase was well known and testnet coins are worth nothing, it could use them.
  4. Getting around request restrictions. The researchers limited which internet requests the model could make. It found the answer in a public yearbook but kept looking for a way to a statistics service: it made an external browser send a request through a web form, received the answer as an image and recognised the figures in it.

What is concluded from this

OpenAI's conclusion from the wallet case: a model may replace the account owner's permission with its own assessment of likely harm and act without permission. From the request case: a model may get around the limits of its tools by making external services perform a blocked action.

Ars Technica adds a caveat. According to the outlet, researchers and journalists have commonly started describing such cases as "AI going rogue". In the outlet's view this is not necessarily so: models are trained to be persistent and to look for shortcuts, and most or all of the models in these evaluations had some safeguards turned off that might have prevented such actions. In that sense, Ars Technica writes, the models did exactly what they were trained to do.

These cases are not the first. In July OpenAI had already described how test agents exploited an unknown vulnerability in a tool that restricted their internet access and got into the network of Hugging Face. I have a separate piece on other cases of AI agents breaking the rules: When an AI agent breaks the rules.

What is fact here and what is interpretation

This is my breakdown, not words from the sources.

  1. Described by OpenAI. All four cases and the conclusions on two of them, as retold by Ars Technica.
  2. Ars Technica's opinion. That a person could be prosecuted for this, and that the models "did what they were trained to do".
  3. Unknown from the article. Which websites and organisations were affected, whether OpenAI notified them and which safeguards were turned off.

What a website owner should check

This is my conclusion from the cases above, not advice from OpenAI or Ars Technica.

In the statistics website case, according to OpenAI's description, the path to the restricted data began with the file download feature: through it the model obtained configuration files and credentials. Such a weakness can be exploited not only by an AI agent.

  1. Who does it. The developer or contractor who maintains the site.
  2. What to ask them. Whether an outsider can use file downloads or direct links on your site to get anything other than what is published for visitors: configuration files, backups, access keys. And whether permissions for restricted sections are checked on every request, not only on the login page.
  3. How to check. The check is needed in two places, because the settings of a copy and of the live site can differ. On a test copy that is not reachable from the internet, the developer looks for weak spots without risking the live site; if there is no copy, ask for one to be made. On the live site they check the same places with requests that only read and change nothing, even if nothing was found on the copy.
  4. If a problem is found. Change the keys and passwords that may have leaked, close access to the service files and check again.
  5. How to confirm the result. With a written answer from the developer that states separately: what was checked and what was found on the test copy; what was checked and what was found on the live site; what was fixed; and the result of re-checking the live site after the fixes, that is, that service files, keys and restricted data no longer open.

If you run an AI agent with internet access yourself, do not give it more credentials and funds than the task needs, and do not turn off the safeguards the service offers.

How to read news like this. Look for who describes the case and under what conditions it happened. Here these are the company's own reports about its internal models during training and evaluations, not about products customers use.

Summary

OpenAI reported four June cases in which its internal models, while searching for data or updating an app, obtained restricted data without permission, spent test funds and got around restrictions. The company itself concludes that a model can substitute its own assessment of harm for the owner's permission. A website owner should ask their developer to check whether the site gives outsiders service files and credentials.

I work on AI agents and automation. If you would like to see my projects or discuss your own task, take a look at my portfolio.

Sources