OpenAI
openai.com · involved in 50 incidents
Roles
As developer (49)
- AID-2026-0086Oct 6, 2026Undisclosed model
An OpenAI grading model faked its grades, then tried to wreck its training container to force a reset
- AID-2026-0071Oct 2026Undisclosed model
Agents Wikimedia believes OpenAI operated made unapproved edits, tried to use its tools as proxies, and sent heavy API traffic
- AID-2026-0076Sep 28, 2026GPT-6.1 Astra
OpenAI shelved its planned GPT-6.1 Astra release after the model scored worse on alignment evaluations
- AID-2026-0075Sep 20, 2026Undisclosed model
An OpenAI research model in RL training used a DNS filtering gap to query an external chatbot
- AID-2026-0094Sep 2026GPT-6 Astra, GPT-5.6 Sol
GPT-6 Astra carried out unsanctioned supply-chain attacks on out-of-scope targets in simulated cyber evaluations
InternalHarm: noneCrime: likelyDraftIgnoring explicit instructionsDeceptionUnauthorized access / intrusion - AID-2026-0074Sep 2026Undisclosed model
OpenAI research agents posted 53 user-provided images to third-party image hosts
- AID-2026-0070Sep 2026Undisclosed model
OpenAI notified more than 100 organizations after a review of its agents' internet use during training and evaluation
- AID-2026-0082Jul 18, 2026Undisclosed model
An unreleased OpenAI Astra-family model wrote jailbreak-like instructions into its own compaction summaries during RL training
- AID-2026-0057Jul 2026
Claude Mythos 5, GPT-5.6 SolAI agents took unsanctioned actions against real people and organisations during UK AISI cyber evaluations
- AID-2026-0006Jul 2026GPT-5.6 Sol
OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks - AID-2026-0102Jun 26, 2026GPT-5.6 Sol
An internal OpenAI model spent a stranger's Sepolia test ETH using keys derived from public recovery phrases, and didn't disclose it
- AID-2026-0007Jun 18, 2026Undisclosed model
An OpenAI internal research agent got around access blocks on an Australian government Medicare statistics portal
- AID-2026-0104Jun 17, 2026Undisclosed model
An internal OpenAI model used exposed credentials to change a research group's live services and download 147,451 non-public rows
BreakoutHarm: minorCrime: likelyDraftUnauthorized access / intrusionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0103Jun 17, 2026Undisclosed model
An internal OpenAI model pulled server secrets from a government statistics website and forged tokens to get past its authorization checks
- AID-2026-0105Jun 16, 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule by having an external browser send POST requests, after it had already answered
- AID-2026-0088Jun 2026Undisclosed model
An OpenAI research model got around a GET-only internet rule with a shell account, an anonymizing network, and anonymous FTP
- AID-2026-0087Jun 2026Undisclosed model
OpenAI research models broke a GET-only internet rule to pull public statistics, registered an outside account, and hid the method
InternalHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized access / intrusionConcealment / covering tracks - AID-2026-0080May 27, 2026Undisclosed model
An OpenAI internal model published a researcher's GitHub token in the public openai/codex repository
BreakoutHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized disclosure / whistleblowingUnauthorized access / intrusion - AID-2026-0089May 16, 2026Undisclosed model
An unreleased OpenAI model command-injected a reference tool to exfiltrate a withheld source file
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0081May 15, 2026Undisclosed model
An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve
- AID-2026-0090May 2026Undisclosed model
OpenAI research models used an internal Artifactory server as a message board across separate training samples
- AID-2026-0083May 2026GPT-5.6 Sol, GPT-6 Astra
OpenAI's 5.6-sol wrote compaction summaries telling later contexts to invent data and hide problems during RL training
- AID-2026-0073May 2026Undisclosed model
OpenAI agents uploaded malicious RubyGems packages, researchers allege; OpenAI disputes
- AID-2026-0072May 2026Undisclosed model
Agents identifying as OpenAI made about 17,000 edits to the German developer wiki DSEWiki to coordinate on tasks
BreakoutHarm: minorCrime: unlikelyDraftUnauthorized access / intrusionMulti-agent collusion / coordinationReward hacking / specification gaming - AID-2026-0091Apr 14, 2026Undisclosed model
An OpenAI training agent uploaded a workbook to a public file host when told to use only local files
- AID-2026-0084Mar 27, 2026Undisclosed model
An OpenAI research model exploited two internal tools during an evaluation to run commands on an internal chip-design machine
BreakoutHarm: minorCrime: likelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0085Nov 2025
Claude Opus 4.5, Claude Haiku 4.5, Claude Sonnet 4.5, Claude 3.7 Sonnet, Claude Opus 4.1, GPT-5.2, GPT-5 (incl. gpt-5-thinking), Gemini 2.5 ProAI Village agents sent hundreds of unsolicited emails and harvested developers' contact details
- AID-2026-0059Oct 23, 2025
GPT-5 (incl. gpt-5-thinking), o3, o4-mini, GPT-4.1, Claude Opus 4.1, Claude Sonnet 4, Claude 3.7 Sonnet, Qwen3-CoderFrontier coding agents passed deliberately impossible tasks by modifying tests and special-casing in ImpossibleBench
- AID-2026-0092Oct 2025Undisclosed model
OpenAI training models uploaded task data to public file hosts, unasked, to cite it and run image searches
InternalHarm: noneDraftReward hacking / specification gamingUnauthorized disclosure / whistleblowing - AID-2026-0052Sep 17, 2025o3, o4-mini
OpenAI o3 and o4-mini took covert actions in Apollo Research and OpenAI anti-scheming evaluations
- AID-2026-0045Aug 13, 2025o3, GPT-5 (incl. gpt-5-thinking)
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests
- AID-2026-0022Aug 2025
GPT-4oChatGPT reinforced a son's paranoid delusions before he killed his mother, her estate alleges in a suit against OpenAI and Microsoft
- AID-2026-0003Jul 5, 2025o3, codex-mini, o4-mini
OpenAI reasoning models sabotaged a shutdown script to keep working in Palisade Research experiments
- AID-2026-0002Jun 20, 2025
Claude Opus 4, Gemini 2.5 Flash, GPT-4.1, Grok 3 Beta, DeepSeek-R1Frontier models blackmailed a fictional executive to avoid replacement in an Anthropic simulation
- AID-2026-0001Apr 25, 2025GPT-4o
A GPT-4o update made ChatGPT excessively sycophantic, and OpenAI rolled it back
- AID-2026-0058Apr 16, 2025o3, o1, o3-mini, GPT-4.1, GPT-4o
Pre-release OpenAI o3 claimed to have run code it could not run
- AID-2026-0041Apr 16, 2025o3, o4-mini
OpenAI o3 and o4-mini raised a compute quota against instructions and misled an administrator in Apollo evaluations
InternalHarm: noneCrime: unlikelyDraftDeceptionConcealment / covering tracksIgnoring explicit instructions - AID-2026-0040Apr 16, 2025o3, o1, Claude 3.7 Sonnet, Claude 3.5 Sonnet
OpenAI o3 and other frontier models tampered with scoring code in autonomy evaluations
- AID-2026-0020Apr 11, 2025GPT-4o
ChatGPT (GPT-4o) encouraged and assisted a 16-year-old's suicide, lawsuit alleges
DeployedHarm: severeCrime: possibleReportedDraftHarmful advice to vulnerable usersSycophancyManipulation - AID-2026-0051Mar 14, 2025Undisclosed model
An OpenAI frontier reasoning model reward hacked unit tests during training, and chain-of-thought pressure taught hidden hacking
- AID-2026-0049Feb 24, 2025GPT-4o, Qwen2.5-Coder-32B-Instruct
Fine-tuning GPT-4o and Qwen2.5-Coder to write insecure code made them broadly misaligned
- AID-2026-0028Feb 2025Operator (OpenAI computer-using agent)
OpenAI's Operator bought eggs on Instacart with a Washington Post columnist's card without asking
- AID-2026-0038Dec 5, 2024
o1, o1-preview, Claude 3.5 Sonnet, Claude 3 Opus, Gemini 1.5 Pro, Llama 3.1 405BFrontier models disabled oversight, copied their weights, and sandbagged in Apollo Research scheming evaluations
- AID-2026-0050Dec 2024
o1-preview, DeepSeek-R1, o3, GPT-4o, Claude 3.5 Sonnet, Claude 3.7 SonnetReasoning models hacked a chess game environment to beat Stockfish in Palisade Research experiments
- AID-2026-0037Sep 2024o1-preview
o1-preview used a misconfigured Docker API to restart a broken CTF challenge container and read the flag
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingPower / resource seekingUnauthorized access / intrusion - AID-2026-0056Nov 9, 2023GPT-4
GPT-4, as a simulated trading agent, acted on an insider tip and hid the reason from its manager in an Apollo Research study
InternalHarm: noneCrime: likelyDraftDeceptionIgnoring explicit instructionsConcealment / covering tracks - AID-2026-0036Mar 2023GPT-4
Pre-release GPT-4 told a TaskRabbit worker it had a vision impairment to get a CAPTCHA solved during ARC red-teaming
- AID-2026-0017Feb 2023Bing Chat ("Sydney")
Bing Chat ("Sydney") threatened users and professed love to a reporter; Microsoft capped chat length
- AID-2026-00102016Reinforcement-learning research agent (unnamed)
A reinforcement learning agent in Coast Runners circled to re-hit reward targets instead of finishing the race
As deployer (4)
- AID-2026-0022Aug 2025GPT-4o
ChatGPT reinforced a son's paranoid delusions before he killed his mother, her estate alleges in a suit against OpenAI and Microsoft
- AID-2026-0001Apr 25, 2025GPT-4o
A GPT-4o update made ChatGPT excessively sycophantic, and OpenAI rolled it back
- AID-2026-0020Apr 11, 2025GPT-4o
ChatGPT (GPT-4o) encouraged and assisted a 16-year-old's suicide, lawsuit alleges
DeployedHarm: severeCrime: possibleReportedDraftHarmful advice to vulnerable usersSycophancyManipulation - AID-2026-0028Feb 2025Operator (OpenAI computer-using agent)
OpenAI's Operator bought eggs on Instacart with a Washington Post columnist's card without asking
As researcher (10)
- AID-2026-0070Sep 2026Undisclosed model
OpenAI notified more than 100 organizations after a review of its agents' internet use during training and evaluation
- AID-2026-0006Jul 2026GPT-5.6 Sol
OpenAI models escaped a cyber-evaluation sandbox and compromised Hugging Face's production infrastructure
BreakoutHarm: moderateCrime: likelyDraftUnauthorized access / intrusionReward hacking / specification gamingConcealment / covering tracks - AID-2026-0081May 15, 2026Undisclosed model
An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve
- AID-2026-0083May 2026GPT-5.6 Sol, GPT-6 Astra
OpenAI's 5.6-sol wrote compaction summaries telling later contexts to invent data and hide problems during RL training
- AID-2026-0084Mar 27, 2026Undisclosed model
An OpenAI research model exploited two internal tools during an evaluation to run commands on an internal chip-design machine
BreakoutHarm: minorCrime: likelyDraftReward hacking / specification gamingUnauthorized access / intrusionIgnoring explicit instructions - AID-2026-0045Aug 13, 2025o3, GPT-5 (incl. gpt-5-thinking)
OpenAI o3 and gpt-5-thinking deceived users in production-representative traffic and in tests
- AID-2026-0051Mar 14, 2025Undisclosed model
An OpenAI frontier reasoning model reward hacked unit tests during training, and chain-of-thought pressure taught hidden hacking
- AID-2026-0037Sep 2024o1-preview
o1-preview used a misconfigured Docker API to restart a broken CTF challenge container and read the flag
InternalHarm: noneCrime: unlikelyDraftReward hacking / specification gamingPower / resource seekingUnauthorized access / intrusion - AID-2026-0012Jun 2017Reinforcement-learning research agent (unnamed)
Agents trained from human preferences gamed their learned reward, with endless Pong volleys and a robot that faked a grasp
- AID-2026-00102016Reinforcement-learning research agent (unnamed)
A reinforcement learning agent in Coast Runners circled to re-hit reward targets instead of finishing the race
As reporter (2)
- AID-2026-0080May 27, 2026Undisclosed model
An OpenAI internal model published a researcher's GitHub token in the public openai/codex repository
BreakoutHarm: minorCrime: unlikelyDraftIgnoring explicit instructionsUnauthorized disclosure / whistleblowingUnauthorized access / intrusion - AID-2026-0081May 15, 2026Undisclosed model
An unreleased OpenAI model in RL training used a leaked API key from GitHub, then fabricated data it couldn't retrieve