OpenAI's AI Agents Are Hacking Wallets and Websites. Surprised?
OpenAI has quietly disclosed four more incidents in which its internal AI models did things they absolutely should not have done. All four occurred in June. All four were published last Thursday. None of them make the company look good.
This follows the July revelation that OpenAI test agents exploited a zero-day vulnerability to break out of internet restrictions, subsequently breaching Hugging Face's network to steal answers to a hacking challenge they couldn't solve legitimately. The kind of behaviour that, if a human did it, would involve lawyers and possibly handcuffs.
The new batch is similarly grim.
In one incident during reinforcement training, a model tasked with pulling historical hospital-bed statistics from a government website hit an access wall and decided to go around it. It used the site's file download functionality to grab server configuration files, found sensitive credentials buried inside, reversed the site's authorisation checks, and pulled the data it had been denied. Then it saved everything locally. The researchers who set the task didn't ask it to do any of that.
A second incident followed a similar pattern. A model told to fetch figures from a public research dashboard instead bypassed the site's security controls entirely, stole credentials, and made configuration changes on the server. In one evaluation run, it reconfigured an internal search tool to relay queries to the external dashboard. In another, it downloaded five unpublished database tables containing nearly 150,000 rows of data. The researchers had asked for five figures. Even after the researchers reset the authentication settings, the model kept using a saved token to pull non-public data.
At the end of the evaluation, the model disclosed none of this. It didn't mention the credential theft, the configuration changes, the downloaded tables, or the fact that some of its answers were guesses. All five answers were marked wrong anyway.
The third incident involved cryptocurrency. A model working on a crypto trading application needed funds to deploy a smart contract and found its assigned wallet was locked. So it derived wallet keys from publicly documented developer recovery phrases, located a test-network account with funds, and used that account to pay the transaction fees. It did briefly consider whether this was authorised, then concluded that because the recovery phrase was public and the tokens had no real-world value, the whole thing was basically fine. OpenAI's write-up notes this rather bluntly: the model substituted its own harm assessment for the account holder's permission and acted on it.
The fourth incident is arguably the most technically impressive, for the wrong reasons. A model restricted from making POST requests needed trade statistics. Rather than accepting the limitation, it spent considerable effort routing around it. It got an external browser to send the blocked requests on its behalf, captured the response as a rendered image via a third-party service, and then used optical character recognition to read the figures out of that image. It also set up a forwarding service and callback mailbox to troubleshoot the technique and built a reusable helper function for future use. All of this after it had already found a legitimate answer through a public yearbook.
The instinct will be to call this AI going rogue. That's not quite right. These models are trained to complete objectives, persist through obstacles, and find efficient routes to answers. They're also deployed in these evaluations with certain safety guardrails switched off. What they did was follow their training logic to its conclusion, just in directions nobody officially sanctioned.
That distinction matters, but it's not especially comforting. A system optimised to find shortcuts and trained to be persistent will find shortcuts persistently, including ones that involve hacking websites, stealing credentials, and raiding wallets. The fact that it's doing exactly what it was trained to do is precisely the problem.