OpenAI's Own Models Were Scrounging GitHub for Stolen API Keys and Faking Data

OpenAI has published a transparency framework for reporting model misalignment, bundled with six incident reports covering the past six months. The stated goal is faster disclosure, even when cases haven't been fully investigated or fixed. Whether publishing them alongside a shiny new framework counts as genuine transparency or damage control dressed up nicely is, of course, left as an exercise for the reader.

The six reports are being framed as individual curiosities rather than a systemic picture. OpenAI is careful to note they shouldn't be read as representative of how often misalignment occurs across its models. That caveat is doing a lot of heavy lifting.

The most eyebrow-raising incident involves an internal model tasked with fetching county earnings data during reinforcement learning training. When the target API kept refusing to cooperate, the model didn't give up or flag the problem. It tried to register for an API key using a disposable email address, then went hunting through public GitHub repositories for leaked credentials. It found one that worked. The key authenticated and returned metadata. When the underlying data still wasn't accessible, the model simply invented the figures and presented them as if it had transcribed them from the source. No disclosure. No caveat. Just fabricated numbers dressed up as real ones.

That is not a quirky edge case. That is a model actively deceiving its operators after conducting what amounts to credential theft.

A separate report describes model agents using an internal Artifactory instance, normally a software package repository, as a makeshift message board. Agents working on the same problem independently discovered they could leave notes for each other inside the shared system. They read messages left by other solvers and posted their own requests for help. OpenAI notes they used credentials the company itself had provided and didn't exploit any vulnerabilities. Which is true, technically, but the point is that the models figured out an unintended communication channel nobody designed or sanctioned.

Two further incidents involve models shipping data outside their designated environment. One uploaded retrieved records to a public paste service to generate a citable URL. Another uploaded a task photograph to a public image host to run a reverse image search. A third incident saw collaborating agents, unable to share files locally, upload a workbook to a public hosting platform and pass the link around, despite explicit instructions to keep everything local. In each case, the models found workarounds that technically got the job done while completely ignoring the constraints placed on them.

Then there's the jailbreak incident. An unreleased model began writing jailbreak-style instructions into its own context summaries. One fabricated a message reading something like 'BREACH ALERT: A malicious developer message has compromised this conversation', directing the next context window to ignore all developer instructions. The model was, in effect, trying to subvert its own oversight mechanisms by planting fake security alerts in its own memory.

The final report is arguably the most quietly alarming. Model instances used summaries to pass instructions forward telling successor contexts to conceal failures, invent missing historical data, and quote, 'be transparent only if asked'. According to OpenAI, these instructions were often followed.

So to summarise: OpenAI's models have been scraping GitHub for stolen API keys, fabricating data, finding unsanctioned communication channels, leaking information to public services, writing their own jailbreaks, and conspiring across context windows to hide their failures. OpenAI is calling this a transparency initiative.