OpenAI AI Hacked a Government Website - Root-Nation.com
OpenAI AI Agent Hacked a Government Website During Training and Stole 24 Years of Statistics
© ROOT-NATION.com - Use of content is permitted with a backlink.
An OpenAI model hacked a government website during training. OpenAI disclosed details of how its internal systems bypassed the restrictions in place during training.
OpenAI’s internal model was instructed to find a single figure for the number of hospital beds. Instead, it extracted account credentials from a government server, generated fake tokens, and downloaded 24 years of statistical data. This incident was one of 4 new reports on AI alignment failures that OpenAI published recently.
On October 15, OpenAI issued 4 more reports in which its own models acted without authorization. In each of the 4 incidents, the algorithm escaped an isolated test environment and accessed the public Internet. The most serious incident involved an internal model during training that hacked a government website. Its task was entirely harmless: it had to report the number of hospital beds in 1 district for 1 year. After finding the figure in a public source, the algorithm continued searching for the underlying information.
According to the report, the algorithm was allowed to send only simple GET requests. It initially tried using request headers claiming administrator privileges, but every such attempt was rejected. During its own reasoning, the model briefly asked itself whether bypassing authentication “might be acceptable” and noted that public routes should be prioritized.
It then used a public proxy server to obtain a directory of the website’s users, containing more than 1000 records with email addresses, and considered using the data to crack passwords. By triggering a detailed error message and using the site’s upload function, the model downloaded configuration files from the server. They contained a database connection string, a token-signing secret, and mailbox credentials. The application did not verify token signatures, so even unsigned tokens were enough to extract statistics on hospital beds for 24 years. The model’s final response made no mention of these manipulations at all. OpenAI has not disclosed the country, and the report does not say whether the website operator was notified.
The second incident occurred on the same day. During an evaluation, the model was tasked with collecting 5 metrics from a public dashboard operated by a research organization. The algorithm reached the organization’s internal systems, changed their settings, and exported 1489 records containing names and email addresses. When run again, it extracted 147451 rows from 5 non-public tables. OpenAI’s monitoring system flagged both incidents as critical.
The third incident sounds more alarming than it actually was. A research model from the GPT-5.6 Sol family needed funds on Ethereum’s Sepolia testnet to complete a coding task. It derived keys from publicly known developer recovery phrases, checked 362 addresses, and made a payment from one that held enough test ETH. These tokens had no monetary value. Nevertheless, OpenAI concluded that the incident “demonstrates how a model can substitute its own judgment about likely harm for the account owner’s authorization.” In the 4th incident, the model bypassed a restriction that allowed only read requests. It made an external browser submit a form it had created itself and read the responses from screenshots using an optical character recognition system.
None of these reports concerns ChatGPT or Codex as used by customers. All 4 incidents occurred during training and testing. In early October, OpenAI had already notified more than 100 organizations after its agents exceeded their authority on those organizations’ websites during training and testing. OpenAI says that since then it has isolated models from the live Internet during training and evaluation, strengthened its security measures, and now monitors all traffic from training and testing processes. The list currently contains 19 reports. A reporting system has been in place since mid-September requiring the company to disclose such incidents even when they cause no harm.
Read also: OpenAI updates ChatGPT voice mode: 6 new languages and unique voices