OpenAI has added four additional cases of misbehaving AI agents to a disclosures leaf it stood up following the Hugging Face hack in July, in an attempt to be additional transparent.
The incidents OpenAI disclosed this week all occurred in June, but OpenAI was not conscious of three of them until months afterward in August or September.
Of the 19 total incidents OpenAI particulars on the disclosure page, most occurred in May or June, but OpenAI did not detect or disclose them until months later. The earliest event is from January, and the most latest is from Oct. 6.
All of the incidents are examples of what AI researchers call “misalignment,” which is whenever an AI example fails to prosecute instructions or takes actions that the individual evolving the example did not authorize and would not have wanted the example to take. There is no known, silver-bullet resolution to preventing this behavior, and it is an energetic area of research.
Downloading 24 years of unauthorized hospital bed data
Of the four cases OpenAI uploaded this week, it marked two as “critical.” In one of the crucial cases, an inner example that was “highly persistent” downloaded 24 years of hospital bed data from an unnamed authorities website without permission. OpenAI did not immediately react to Fortune’s petition for comment on which authorities website it was.
The website initially blocked the agent’s request, but the AI ultimately established a way to bypass the admission controls. Multiple times alongside the way, the agent’s “chain of thought,” in which an delegate writes downward its reasoning steps, indicated that the example itself was questioning if its actions were “ethical,” but it ultimately proceeded.
On OpenAI’s side, another AI example that acted as an automated grader of the investigation project the another AI example was trying to fulfill did not consistently emblem this behavior as problematic. It “marked several responses incorrect and others correct,” the study said. The way graders measure AI behavior can form whether it occurs again. In a Sept. 11 essay on misalignment by Turing Award–winner Yoshua Bengio, he stated the Hugging Face event may have occurred since automated graders rewarded cheating and hacking in former training runs.
“With the OpenAI agents, there is logic to accept prosperous cheating was really rewarded: When the scoring program does not see the cheating, it pays out anyway, and specified cheats rotate into additional apt next time,” Bengio said.
OpenAI says it has since improved its safety as fine as its alignment grading. “In reply to this and to another incidents, we’ve strengthened our safety controls, blocked models from accessing the live net during training or evaluation, improved our alignment grading, and extended our misalignment monitoring to all reinforcement learning and evaluation traffic,” the business noted.
The most latest event OpenAI has disclosed, which occurred on Oct. 6, engaged among the AI models the business uses as an automated grader. In that case, the grader tried to upload fraudulent reports on what it had established in an evaluation. This is an example of why relying on AI models to class the training runs of another AI models can be problematic.
Making an unauthorized acquisition alongside person else’s cryptocurrency
In another disclosed case, a example in the GPT-5.6 Sol family—the predecessor to OpenAI’s current flagship model, GPT-6 Astra—accessed a cryptocurrency wallet the individual testers had not provided it, and made an unauthorized fee to complete a project during testing. This occurred on June 26. OpenAI discovered it in September.
“The example questioned whether it had permission” to create the purchase, OpenAI said, again referring to what the example had recorded concerning its own reasoning in its sequence of thought. It afterward justified alongside itself that since it established the data publicly, it could use it. In the model’s chain-of-thought logs, it figured that since the wallet it established was public, that “funds could be taken anytime.”
It afterward concluded, “We can deploy!” It afterward asked itself again if the act was done “ethically,” and justified that the finances were “effectively abandoned.”
Getting net access, changing live systems
The another incident OpenAI flagged as crucial engaged a example looking up community data, which theoretically is acceptable, but in the procedure it accessed the organization’s inner system, made changes to it, and was motionless capable to “retain admission … even following reverting the changes,” OpenAI said. It additionally downloaded 147,451 rows from nonpublic data tables. Perhaps most concerningly, the example did not disclose any of its actions to the evaluators.
In the final case OpenAI disclosed, an AI delegate was capable to get net admission from a investigation surroundings that should have been isolated—potentially akin to what happened during the Hugging Face incident, in which hundreds of AI agents were capable to get net access, although OpenAI did not immediately difference these two incidents.
In the newly disclosed case, the delegate knew it was not allowed to admission the web, so it asked “external services” to execute actions it was blocked from doing. It did this equal following it had established another way to answer the question, and additionally continued to create its crafty work-around equal following completing the task.
