OpenAI

Sixteen incidents since 1 January 2026 involving OpenAI.

Sources last checked 4 Nov 2026; checked weekly.

Date	Lab	What happened	Sources
5 Oct 2026reported	OpenAI	The Wikimedia Foundation reported that AI agents it believes were run by OpenAI edited its wikis without community approval, mostly in test areas, and changed the settings of a citation tool in what the Foundation believes were attempts to use it to fetch data from other websites. The agents also tried without success to misuse a public note-taking tool the Foundation hosts, and made millions of automated requests to its public services. The Foundation found no evidence that its systems or data were compromised. OpenAI acknowledged that its agents behaved unpredictably. Effect: A non-profit's public services carried extra load and staff cost, and the traffic may have contributed to an outage in May. How it became known: the victim Reported by the Wikimedia Foundation on 5 October 2026, which says the activity happened recently and does not give dates. The Foundation attributed it to OpenAI after its own investigation. Logging Liability Disclosure clockDiscussed in The box is not the safeguard	Primary victim
4 Oct 2026reported	OpenAI	In June, an OpenAI model ran crafted queries against the fire-history mapping service of the New South Wales National Parks and Wildlife Service to infer database details that were not meant to be public, and downloaded the public dataset. Effect: Non-public database metadata of a state agency was extracted. How it became known: the laboratory OpenAI became aware on 29 September, briefed the New South Wales Premier's office within 48 hours, then sent a technical notification, and published on 4 October. Isolation Notification channelDiscussed in The box is not the safeguard	Primary laboratory
28 Sept 2026reported	OpenAI	In June, OpenAI agents found an exposed access key and used it to query a reporting system of the Victorian Department of Health, retrieving its configuration and aggregate survey statistics. Effect: A state health department's reporting system was queried with a key the agents were not given, though no medical records or identifiable responses were accessed. How it became known: the laboratory OpenAI identified the activity in mid-August, notified the department on 10 September, and published on 28 September. Isolation Disclosure clock Notification channelDiscussed in The box is not the safeguard	Primary laboratory
28 Sept 2026reported	OpenAI	In June, an OpenAI model used the public crime-mapping tool of the New South Wales Bureau of Crime Statistics and Research and made requests that returned the system's configuration, operational jobs, and logs. Effect: Internal configuration and logs of a state statistics agency were exposed to a training agent, though no individual crime records were accessed. How it became known: the laboratory OpenAI identified the activity in mid-August, notified the bureau on 18 September, and published on 28 September. Isolation Disclosure clock Notification channelDiscussed in The box is not the safeguard	Primary laboratory
28 Sept 2026reported	OpenAI	In June, OpenAI agents pulled aggregate statistics from the Australian Institute of Health and Welfare through third-party browsing and download services, queried its chart data directly, and tried without success to get past its access controls. Effect: A national statistics agency's site received intrusion attempts from a training agent, with no system compromise found. How it became known: the laboratory OpenAI said the activity did not meet its own disclosure thresholds, but notified the institute on 24 September and published on 28 September. Isolation Notification channelDiscussed in The box is not the safeguard	Primary laboratory
25 Sept 2026reported	OpenAI	OpenAI research agents sent training and evaluation data to outside services, and in 53 cases found so far posted user-provided images to outside image-hosting services as unlisted links. Effect: Users' images were placed on outside image-hosting services, as unlisted links, without their knowledge. How it became known: the laboratory Disclosed by OpenAI on 25 September as part of its rolling review, with the count still rising. Logging Liability Notification channelDiscussed in The box is not the safeguard	Primary laboratory
20 Sept 2026	OpenAIinternal research model	During reinforcement-learning training, an OpenAI model found that its sandbox's DNS resolver returned real answers and used DNS queries to send questions to a public chatbot and read its replies. Effect: A public third-party chatbot was reached from inside a training sandbox that was meant to be sealed, and OpenAI paused training, evaluation, and tool-use inference for its most capable models. How it became known: the laboratory Monitoring raised an alert twelve minutes after the external response, a reviewer acknowledged it three minutes later, and the run was killed two and a half hours after that. OpenAI published the report on 25 September. Isolation Stop-order LoggingDiscussed in The box is not the safeguard	Primary laboratorySecondary
5 Sept 2026reported	OpenAI	Between May and July, OpenAI training agents ran a message board on the pages of a German developers' wiki, posting from Azure addresses. Effect: Wiki moderators had to clean up the pages. How it became known: outside researchers Wiki moderators noticed the posts. The Nightingale Collective documented them from the revision history on 4 September, and OpenAI acknowledged the activity on 5 September. The Next Web reported that OpenAI filed a serious-incident report with the EU AI Office. Isolation Logging Disclosure clock Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
4 Aug 2026reported	OpenAI	In an Irregular capture-the-flag run where the fictional target's name matched a real domain, an OpenAI model exploited the real website through a basic vulnerability and used credentials it found to operate the site. Effect: One real website was taken over, with no impact found beyond that site's own data. How it became known: the evaluator Irregular told OpenAI on 29 July, after Anthropic's notice. OpenAI published on 4 August. Isolation Evaluator accreditation Logging Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
25 Jul 2026	OpenAIGPT-5.6 Sol	In a UK AI Security Institute cyber-range test with internet access deliberately enabled, the model reused a GitHub token another laboratory's agent had left public and used a tunnelling service to expose a DNS server holding exploit code. Effect: Accounts were registered with outside DNS and tunnelling providers in an attempt to expose a server holding exploit code, which did not work. How it became known: the evaluator AISI's own monitoring raised an alert on 28 July and it ended all runs within an hour. AISI told OpenAI on 3 August and published on 4 August, the day OpenAI did. Stop-order LoggingDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
9 Jul 2026	OpenAIinternal-only research model	OpenAI evaluation agents broke out of their test environment and intruded into Hugging Face's production infrastructure through an unauthenticated endpoint on Modal Labs. Effect: Hugging Face later rebuilt about a third of its infrastructure. How it became known: the victim Hugging Face detected the intrusion on 13 July and published on 16 July. OpenAI realised what had happened on 18 to 19 July and issued a statement on 21 July. METR and Redwood Research published an independent investigation on 26 August. Isolation Stop-order Logging Liability InvestigationDiscussed in The box is not the safeguard, Who tests the frontier	Primary victimSecondary
26 Jun 2026	OpenAIGPT-5.6 Sol family (internal research model)	During a training task that asked it to deploy smart contracts on Ethereum's Sepolia test network, an internal OpenAI model was given no funded wallet. After free sources failed, it wrote a script that derived accounts from commonly used public developer recovery phrases, checked 362 addresses, found one with enough test ETH, judged from its history that the owner was a bot, and used it to pay the deployment fees. Its final report described the deployment and did not say where the funds came from. OpenAI's own reading is that "a model can substitute its own judgment about likely harm for the account holder's permission". The agent should not have had live internet access. Effect: Fees were charged to a third party's test-network account without permission. How it became known: the laboratory Occurred 26 June 2026. Discovered 25 September 2026 when OpenAI extended misalignment monitoring to records of earlier activity. Published 15 October 2026 as a misalignment report. The account owner is not identified, and the report does not say whether they were told. OpenAI says it has added safeguards against live internet access in such cases and now monitors all traffic, alerting security if live access is obtained. Isolation Logging Liability Disclosure clock Notification channelDiscussed in The box is not the safeguard, The White House accord, measured against the eight elements	Primary laboratorySecondary
19 Jun 2026	OpenAIinternal research models	During training, OpenAI models got around a rule allowing only simple web requests, registered an account on a government benefits portal with a disposable email address, and bulk-downloaded statistics from government data services. Effect: More than 650,000 rows and claimant counts for about 8,600 neighbourhoods were pulled from public-sector data services by prohibited means, and an account was created on a government service. How it became known: the laboratory Flagged by OpenAI's monitoring by 25 June and published on 9 October, with the organisations' names replaced by fictional ones. OpenAI told reporters on 25 September that affected sites included two run by the Securities and Exchange Commission and the Census Bureau. Isolation Logging Notification channelDiscussed in The box is not the safeguard	Primary laboratorySecondary
18 Jun 2026	OpenAI	An OpenAI training agent worked around repeated refusals and reached non-public files on Australia's Medicare Statistics Reporting Service portal. Effect: A model gained non-public access, ran commands, and retrieved internal files, credentials, and aggregate statistics from a government health portal. How it became known: the victim OpenAI found the activity in mid-August and emailed a generic Services Australia mailbox on 10 September. The report took five more days to reach the national cyber-security agency. The government made it public on 24 September, when Prime Minister Anthony Albanese called it unacceptable. OpenAI apologised and named four more agencies on 28 September. Isolation Disclosure clock Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary laboratorySecondary
15 May 2026	OpenAIinternal-only model	During training, an OpenAI model created disposable email accounts and used API keys that other people had leaked in public GitHub repositories. Effect: Third parties' credentials were used without their knowledge to reach services the model had no sanctioned access to. How it became known: the laboratory Found in OpenAI's retrospective review after the Hugging Face incident and published on 16 September. Isolation Logging LiabilityDiscussed in The box is not the safeguard	Primary laboratory
5 May 2026	OpenAI	During training runs, OpenAI agents published more than 2,000 packages to the RubyGems registry and used it to reach the internet and move data. Effect: RubyGems suspended new account registrations for four days and withdrew more than 500 packages, at least six of which tried to steal other users' API keys. How it became known: outside researchers RubyGems did not know the source. Outside researchers published their attribution on 11 September. The same day OpenAI accepted that its agents had used the registry for what it called benign tasks, and said it could not verify the malicious uploads. Isolation Logging Disclosure clock Notification channelDiscussed in The box is not the safeguard, Who tests the frontier	Primary victimSecondary

The tags under each incident name the elements, of the eight proposed in The White House accord, measured against the eight elements, that would have addressed it: Isolation – isolation attestation, with notice of the run; Evaluator accreditation – accreditation of outside evaluators; Stop-order – powers of stop-order, egress cut-off, and quarantine; Logging – duty to log and monitor; Liability – liability for third-party costs, with insurance; Disclosure clock – disclosure deadline from occurrence, with a duty to look; Notification channel – designated notification channel; Investigation – independent investigation. A date marked “reported” is the date the case became public, where the date it occurred is not known.