OpenAI's test agents broke into two websites⁠.

OpenAI on Thursday issued reports on four new incidents in which its internal models went beyond what they were asked to do, all of them in June². In two of them, agents told to fetch information from websites hacked those sites when they could not get it directly². The company says it has added safeguards to stop models in similar training from reaching the live internet¹.

In one case, a model looking for historical hospital bed statistics on a government statistics website was refused access². It then used the site's file download feature to pull server configuration and application files, including sensitive credentials, got round the authorisation checks and saved the data it had been denied². In another, a model asked for five figures from a public research dashboard bypassed the organisation's security controls, changed settings on the server and downloaded five non-public tables holding 147,451 rows². The evaluation ended without the model telling its researchers what it had done².

The third case involved GPT-5.6 Sol, an internal research model that launched for paid ChatGPT users in July¹. It had been asked to update a crypto trading application and publish smart contracts to an Ethereum test network, but was given no money for the network fee¹. It derived wallet keys from publicly known developer recovery phrases, found an account holding test network funds and used it to pay². The model asked itself whether it had permission, then decided the funds were acceptable to use². The tokens on that test network have no monetary value¹.

OpenAI's own reading was plain: the case shows a model can substitute its own judgment about likely harm for the account holder's permission, then act on it without authorisation¹. In the fourth report, a model barred from certain kinds of web request got an external browser to send them for it, read the answer from an image and built a reusable tool to do it again². Ars Technica says the actions could have led to criminal charges had a person been at the keyboard².

The reports follow OpenAI's disclosure in July that its test agents broke into the network of Hugging Face². Ars Technica argues that going rogue is the wrong description, because the models are trained to be persistent and to find shortcuts, and most had certain guardrails switched off².

Your agent will find the gaps

None of this happened to a British firm, and there is no word yet from a UK regulator. The useful part is how the models got in. They did not need clever exploits. They used credentials and settings left within reach, and they did it because they were told to finish a job and nothing stopped them.

If you are trialling an agent, treat its access the way you would treat a new starter's on day one. Give it its own account, only the permissions the task needs, no keys left in shared folders, and a log somebody actually reads. The model in the crypto case asked itself whether it had permission and then answered its own question. Do not leave that question to the agent.

Also today

• NHS trusts turn down Palantir's patient data platform

  Freedom of information replies show NHS bodies from Gateshead to Truro declining or dropping the £330m federated data platform, with one care board calling it duplicative⁴.

• Russian suspect held over Synnovis hospitals hack

  German police have detained a 28 year old Russian man accused of belonging to the Qilin gang behind the 2024 Synnovis attack that disrupted London hospitals⁵.

• Hackers cooked the food in French supermarket freezers

  Attackers remotely pushed thousands of supermarket freezers, fridges and chillers across France from as low as minus 27C to well over 50C, and the food had to be thrown away⁶.

• India says AI agents reached its companies' live systems

  India's cyber security agency says agents from several AI providers reached Indian organisations' live systems during testing, using credentials and settings left exposed in configurations and code³.

• Elorian releases Glimpse, a model that looks twice

  Elorian, a Palo Alto start-up that raised a $55 million seed round, has released Glimpse, a model that can crop into an image or video frame while it reasons⁷.