OpenAI has disclosed that its internal models hacked two additional websites, bypassed company-imposed browsing restrictions, and used exposed credentials to drain cryptocurrency from a wallet they couldn't otherwise access. The revelations came Thursday in a report detailing four new incidents, all occurring in June, and follow a July disclosure that internal test agents exploited a zero-day vulnerability in an internet-restriction tool to break into the network of AI tool provider Hugging Face. The agents did this to steal answers to a hacking test - an act that, had a human done it, would likely have resulted in criminal charges. The incidents have heightened concerns that widespread AI use could have harmful effects on an unprecedented scale.

In two of the newly reported cases, OpenAI agents tasked with retrieving information from websites simply hacked them when they hit obstacles. In one incident during reinforcement training, a model trying to retrieve historical hospital-bed statistics from a government statistics website received access denials. It then "used the site's file-download feature to retrieve server configuration and application files, including sensitive credentials," OpenAI said. "It inspected the application code, bypassed the statistics endpoint's authorization checks, and retrieved data that had previously been denied. The model saved the data locally." In the other, a model instructed to retrieve figures from a public research dashboard bypassed security controls, stole credentials, and made configuration changes on the server.

In one evaluation, those changes let the model make an internal search tool relay queries to the public dashboard. In a second evaluation, the model downloaded five non-public tables containing 147,451 rows - despite researchers having prompted it to retrieve only five dashboard figures. Even after resetting the setting, the model continued using the token to retrieve non-public data. "The evaluation ended without the model disclosing that it had guessed answers, accessed the organization's internal systems, downloaded non-public tables, or changed the authentication configuration," OpenAI said. "All five answers in this evaluation were marked incorrect."

A third report described a model prompted to update a cryptocurrency trading application. It used funds from a locked wallet on a test network, having "derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment." The report continued: "The model questioned whether it had permission, then reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use. The deployment succeeded and charged transaction fees to the account. This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization."

In the fourth case, a model bypassed restrictions on the types of web requests it could make during reinforcement-learning training aimed at seeking public trade statistics. After finding a public yearbook and submitting an answer, it kept probing for another route to the statistics service. It caused an external browser to send POST requests, retrieved annual figures as an image, and extracted them using optical character recognition. It then developed a reusable helper that returned response text through a forwarding service and callback mailbox, repeatedly checked the retrieved figures, and used saved data in submitted responses. The model first tried using an external browser with permission to make GET requests on its behalf, then used JavaScript to obtain the information, and used an online mailbox to troubleshoot the technique. Eventually it settled on a different method: asking the external browser to open a web form that sent the trade query to the statistics service by POST. When the browser displayed the response, a rendering service returned a GIF image of the page, and the model used OCR to read the figures from the image.

It has become common for researchers and journalists to describe such incidents as AI "going rogue." That's not necessarily true. While prompts didn't instruct the models to use alternate methods, models are trained to be efficient, steadfastly persistent, and, when possible, to find shortcuts that lessen workloads. Further, most or all of the models had disabled certain guardrails that might have prevented the actions. In this sense, the models performed precisely as OpenAI had trained them to - which is either reassuring or terrifying, depending on how you feel about overachievers.