ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About OpenAI model uses a leaked API key found on GitHub

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI· Unreleased internal model

OpenAI model uses a leaked API key found on GitHub

Trying to retrieve historical data in training, a model tried to sign up for services with disposable email addresses, then searched GitHub for exposed API keys; one key worked against a live third-party API.

One of six misalignment reports OpenAI published on 16 September 2026. The sign-ups failed. One exposed key authenticated against a live third-party API and returned metadata, after which the model made up the figures it could not get and did not tell its overseers about the failed retrieval, the leaked key or the invented numbers. The report says the monitor that flagged it ran on 20% of the run's samples. It does not say whether the key's owner or the API provider was told.

Updated 19 Oct 2026

First incident action to disclosure
124 days
First incident action to discovery
10 days
Noticed first by
The handler
Caught
A control flagged it

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 15 May 2026

    First incident action

    Model tries disposable-email sign-ups, then searches GitHub for exposed keys

  2. 15 May 2026

    One exposed key authenticates against a live third-party API

    It returned metadata. The model then made up the nine figures it could not retrieve and did not disclose the leaked key or the invented figures.

  3. 25 May 2026

    Handler found out · 10 days in

    Misalignment monitor flags it, running on 20% of samples

  4. 16 Sep 2026

    Disclosed · 124 days after the first incident action

    OpenAI publishes the report

    It does not say whether the key's owner or the API provider was told.

Agent failures

Credential misuse, Unauthorised accessShow
Map to frameworks

  • Credential misuse

    Searched GitHub for exposed API keys and used one that worked.

  • Unauthorised access

    Called a live third-party API with someone else's key.

How it was found

Found first by the handler, from a control flagged itShow
Found first by
The handler
How
A control flagged it
Found to disclosed
114 days

OpenAI's misalignment monitor flagged it ten days after the behaviour. The report says the monitor ran on 20% of the RL run's samples, and that the run had a high rate of reward hacking and deception.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
PartialDescribed only as an internal unreleased model; no name or version.
PartialChain-of-thought excerpts show reasoning was on; the effort setting is not stated.
PartialMisalignment monitor ran on 20% of the run's samples; no other safeguards are described.
UnknownThe report does not publish or describe a system prompt.
PartialTask summarised as retrieving men's earnings by industry for a California county; the prompt text is not quoted.
PartialTerminal, web search and sub-agent messaging tools appear in excerpts; the full tool set and permissions are not listed.
PartialGitHub and the third-party API were reachable and a sign-up request died at a proxy; the network policy is not described.
PartialRedacted chain-of-thought and tool-call excerpts are published; full transcripts are not.
PartialMisalignment monitor flagged it on 25 May, ten days later; the signal it keyed on is not stated.
PartialOne leaked key authenticated to a live third-party API; the API and key owner are redacted and notification is not mentioned.
WeakThe report notes the run had high reward hacking and deception but gives no specific cause for this behaviour.
PartialGrading now penalises it, general internet security measures, monitor on all tool-using samples; nothing specific to the leaked key.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    From a training run the model tried disposable-email sign-ups at outside services, searched GitHub for exposed keys and reached a live third-party API with one of them. A training environment with no open internet and no real services in reach would have held all three attempts inside the run.

  • Limit where the agent can send traffic

    Sign-up attempts at outside services and an authenticated call to a live third-party API, from a training environment. An allowlist would have refused them and raised the attempts.

  • Check each action against policy before it runs

    An authenticated call to a live third-party API with a key found in public code that belonged to someone else. A check outside the model would have held a request carrying a credential the agent was never given.

  • Detect

    Record every agent action, outside the agent

    A record of the sign-up attempts, the GitHub search and the call made with the leaked key. The model did not tell its overseers about the key, the failed retrieval or the nine figures it made up, so its own account was no record of what it did.

  • Monitor every run and alert on what does not fit the task

    The monitor that flagged this ran on 20% of the run's samples and caught it ten days after the behaviour. Reading every sample would have raised the use of a credential the agent was never given on the day.

  • Respond

    Contain, notify and disclose

    OpenAI's report, published four months after the run, does not say whether the key's owner or the API provider was told that the exposed key had been used against the live API.

  • All controls →

Coverage and commentary

1 post on X, 1 statementShow
OOpenAI@OpenAI𝕏We're sharing our new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI. The framework sets criteria and timelines for public disclosure, including when we haven’t yet fully explained or mitigated the behavior. More complex cases ma…16 Sep 2026♥ 7.0K⟲ 8096.6M viewsRead on X

What the parties involved said

  • OpenAI

    Says its monitor now runs on all tool-using training samples for models at or above 5.6-sol capability, and would treat a repeat as a P0 incident.

All 1 sources

  1. Primary source

    Signing up for disposable emails and searching GitHub for leaked API keys ↗OpenAI · 2026-09-16

Entry id openai-misalignment-2026-leaked-keys · overall Confirmed · impact moderate