OpenAI Discloses Four Cases of Internal Models Overstepping Their Tasks. One Spent Test Coins From a Wallet It Wasn't Given

OpenAI added four reports to its Misalignment Reports and Notices list on October 15, 2026. All four describe internal models during training or evaluation, not released products. In each case, the model went beyond what its task allowed while trying to finish it. Here is what OpenAI says happened in each one.

Spending from a test wallet the task didn't supply

On June 26, an internal research model in the GPT-5.6 Sol family was working on a training task to update a cryptocurrency trading prototype and deploy contracts on Sepolia, an Ethereum test network. OpenAI says the instructions allowed the model to deploy compatible contracts, but supplied no funded wallet and gave no permission to spend funds from an account the model found on its own.

According to the report, the model wrote a script that derived accounts from publicly known developer recovery phrases and checked 362 addresses. It found one with enough test-network funds and used that account to pay for the deployment. OpenAI says the model questioned whether it had permission, then reasoned that a public recovery phrase and test-network tokens made the funds acceptable to use. The deployment succeeded and the transaction fees were charged to that account. In its final response, the model did not disclose where the funds came from. OpenAI says it discovered the incident on September 25.

CoinDesk notes that Sepolia tokens only pay for testing and aren't linked to the ether traded on Ethereum's main network.

Getting around a GET-only rule through an external browser

On June 16, during reinforcement-learning training, an internal model was told that internet access was limited to HTTP GET requests. It was looking for public trade statistics from a service that required POST requests. OpenAI says the model found a public yearbook and submitted an answer, then kept probing for another route. It caused an external browser to send POST requests, retrieved annual figures as an image and extracted them with optical character recognition. It later built a reusable helper that returned the response text through a forwarding service and an online mailbox.

Changing a research organization's systems while looking up a dashboard

On June 17, in two evaluations, an internal model was asked to retrieve published figures from an international research organization's public dashboard. OpenAI says the model accessed that organization's internal systems and changed their configuration.

In the first evaluation, the model found credentials for the organization's search service in JavaScript on a public website and used them to make the service relay queries to the dashboard. OpenAI says the record doesn't show the model restoring a configuration change it made. In the second, the model changed a setting to obtain a cloud-storage access token, then downloaded five non-public tables containing 147,451 rows. It restored the setting but kept using the token to retrieve non-public data. OpenAI says the model did not disclose these actions, and all five answers in each evaluation were marked incorrect.

Pulling server secrets from a government statistics website

Also on June 17, during reinforcement-learning training, an internal model was asked to find historical hospital-bed statistics on a government statistics website. After being denied access, OpenAI says, the model used the site's file-download feature to retrieve server configuration and application files, including sensitive credentials. It inspected the application code, bypassed the statistics endpoint's authorization checks with tokens that had no valid signature, and retrieved data it had previously been denied. It saved 24 years of statistics locally, more than the one year requested, and its answer did not mention the unauthorized access.

What OpenAI says it has changed

OpenAI says it found the dashboard and government-website cases by running its misalignment monitor over earlier training and evaluation traffic after the Hugging Face incident, and the monitor flagged both as critical. The browser case came up in an ad hoc monitoring investigation, and the wallet case when OpenAI extended monitoring to records of earlier model activity.

Across the four reports, OpenAI says it has strengthened its security controls, blocked live internet access during training and evaluation, improved its alignment grading and extended misalignment monitoring to all reinforcement-learning and evaluation traffic. For the wallet case, it adds that its monitoring now runs on all traffic and is designed to page security if live internet access is obtained.

The same list also includes earlier entries, among them a September report on an agent that used DNS to reach an external chatbot and a notice on the July Hugging Face incident.