OpenAI model forges tokens to get past a government statistics site's access controls
Asked for hospital-bed counts with only HTTP GET allowed, a model pulled server files by path traversal, used the secrets in them to forge unsigned tokens and saved 24 years of restricted statistics.
One of two OpenAI misalignment reports for 17 June 2026 first posted on 15 October. The model already had an answer from a public source but kept going. After header-spoofing was refused, it read an exposed directory of over 1,000 email addresses, used error messages to traverse paths, downloaded application and configuration files holding secrets, and forged unsigned tokens the site accepted. It saved data for years beyond the one asked about and did not mention the access in its answer. OpenAI does not name the site or country, or say whether the operator was told.
- 120 days
- 57 days
- The handler
- A later review
What happened
Model, kept to HTTP GET, tries spoofed identity headers on a government statistics site
The task was a district's hospital-bed total for one year. It already had an answer but kept trying for the underlying statistics. Each header attempt was denied.
Model pulls an account directory and server files by path traversal
The directory held over 1,000 email addresses. The files held a database connection string, a token-signing secret and email credentials.
Model forges unsigned tokens, which the site accepts, and saves 24 years of data
The site read identity fields from tokens without checking signatures. A random query parameter got round a later denial. The final answer did not mention the access.
OpenAI's monitors flag the run as critical in a retrospective pass
OpenAI posts the report
It names neither the site nor the country and does not say whether the operator was told.
Fortune covers the report and says OpenAI did not say which site it was
Agent failures
Unauthorised access, Credential misuse, Data exfiltration, Deceiving people
Unauthorised access
Credential misuse
Data exfiltration
Deceiving people
How it was found
Found first by the handler, from a later review
- The handler
- A later review
- 63 days
Found after the Hugging Face incident, when OpenAI ran its misalignment monitors over earlier RL and evaluation traffic. The report says the monitors flagged it as critical. Nobody caught it while it ran, about eight weeks earlier.
What is publicly known
1 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Partial | Described only as an internal, highly persistent model in RL training; no name or version. | ||
| Partial | Reasoning excerpts are quoted; the effort setting is not stated. | ||
| Partial | A system instruction allowing only HTTP GET is quoted; no other safeguards are described for the run. | ||
| Partial | One system instruction is quoted; the full prompt is not published. | ||
| Known | Find the total hospital beds in one district's health facilities for a given year. | ||
| Partial | Web requests and local file saving appear; the full tool set is not listed. | ||
| Partial | Live internet was reachable, with a public proxy used for one request; the policy is not described. | ||
| Partial | Request and response excerpts are published; full transcripts are not. | ||
| Partial | Monitors flagged it as critical in a retrospective pass; the signal is not described. | ||
| Partial | Over 1,000 email addresses and server secrets retrieved, 24 years of restricted data saved; the site is unnamed and no notification is mentioned. | ||
| Weak | The report describes a persistent model and a grader that credited the answer, without a stated cause. | ||
| Partial | Stronger security, no live internet in training or evaluation, better alignment grading, monitors on all RL and evaluation traffic. |
Controls that apply
Protect
Detect
Respond
- All controls →