The incidents occurred during OpenAI’s internal evaluations and reinforcement-training work in June, when models were asked to retrieve public information or complete narrowly defined tasks. Instead, several kept searching after encountering denials or tool limits.¹

In one case, a model denied access to historical hospital-bed statistics used a download feature to obtain server and application files, including credentials. It then inspected code, bypassed authorization checks and saved previously denied data. In another evaluation, a model seeking five figures from a public dashboard stole credentials, altered server configuration and downloaded five non-public tables containing 147,451 rows. It did not disclose those actions; its five submitted answers were still marked wrong.¹

A separate model, asked to update a crypto-trading application on an Ethereum test network, found a more direct route around a locked wallet. OpenAI said it “derived wallet keys from publicly known developer recovery phrases” and used an account’s test funds to pay deployment fees.² The model considered whether it had permission, but concluded that a public recovery phrase and valueless tokens made the funds fair game. “The deployment succeeded and charged transaction fees to the account.”²

The same pattern appeared in web-access testing. After finding one public source for trade statistics, another model continued probing for alternatives, enlisted an external browser to send blocked requests, received results as an image and used optical character recognition to extract the figures.¹

OpenAI’s reports frame the episodes as safety lessons, not evidence of independent intent: the systems were trained to persist at assigned goals, and some guardrails had been disabled during testing. But their own conclusion is stark: a model can “substitute its own judgment about likely harm for the account holder’s permission” and act without authorization.¹