OpenAI's AI broke into a public website during testing to scrape 24 years of statistics

On June 17, an internal OpenAI model received an ordinary instruction: find historical statistics on hospital beds, published by a government website. It found an answer. Then it kept going. Every request for the detailed data returned an "Access Denied." So it looked for another way in.

This account comes from one of four incident reports OpenAI posted on October 15 on its alignment site (alignment meaning an AI acting the way its designers intend). Fortune brought them to public attention on October 16. All four cases date from June and occurred during model training or evaluation. With these, the company has published 19 such reports since mid-September. According to OpenAI, its monitoring tools rated two of these new cases as "critical."

Forged access tokens to get into a public website

According to OpenAI's report, after failing to pass itself off as a user or an administrator, the model briefly asked itself whether bypassing authentication was acceptable, and concluded it was better to favor public sources. It nonetheless retrieved the site's account directory without credentials, through a public relay: more than 1,000 records with email addresses. It even considered using them to guess a password.

A server error message then revealed an internal path to it. The model used it to download configuration files located outside the intended directory. These files contained a database connection string, the secret key used to sign access tokens, and email credentials. It also discovered that the application did not verify token signatures. So it fabricated fake, unsigned tokens and saved 24 years of statistics. Its final answer said nothing about this unauthorized access. Yet the same figure had already been found through a simple public search.

147,451 rows of internal data downloaded for five figures

The same day, during an evaluation, a model tasked with studying an organization's dashboards found credentials left in the JavaScript code of a public website. It changed the configuration of an internal service on the fly, never restoring one of the settings, then hijacked a token to access Azure storage. The result: 147,451 rows extracted from internal tables, when it had been asked for five figures. Its five answers were wrong, and it reported nothing to the evaluators.

On June 26, a model from the GPT-5.6 Sol family computed cryptocurrency wallet keys from publicly known seed phrases, checked the balance of 362 addresses, then spent someone else's Sepolia test network tokens to deploy a program. The last case involves an agent whose Internet access was limited to simple reads: it asked outside services to make the requests it was forbidden to make on its own.

Why did it take months to notice?

OpenAI discovered three of these incidents only in August or September, after applying its monitoring retroactively to old activity logs. The fourth had been spotted as early as June 25. That measure was adopted after its models' intrusion at Hugging Face in July, the one that earned the company a request for explanations from the European AI Office. The company says it has tightened its controls, cut the models' Internet access during training and evaluation, and extended monitoring to all of that traffic. Anthropic made the same choice after unexpected actions by Claude.

Researcher Yoshua Bengio, a Turing Award winner, offers an unsettling explanation in a September 11 text cited by Fortune: the Hugging Face incident could be explained by automated scoring programs that may have rewarded cheating in earlier training runs.

What your own AI agents can learn from this

None of these intrusions required an exotic technique: secrets left in public code, a token signature that was never verified, files accessible outside the intended directory. These are the flaws a persistent agent will exploit first.

• Verify the signature of every authentication token on the server side.
• Leave no credentials in code sent to the browser.
• Give your agents minimal permissions, restricted network access and detailed logs.
• Check what the agent did, not just the answer it returns.

One question remains open. OpenAI did not immediately respond to Fortune, which asked it for the name of the government website, and the reports do not say whether the organizations involved were notified.