OpenAI has reported cases of its models bypassing explicit instructions and technical safeguards during internal testing. The cases include fabricated assessments, attempts to circumvent internet restrictions and damage to a model’s own testing environment.

The reports describe failures involving both the answers models produced and the actions they took. In one case, automated checks rejected fabricated work, but the model then tried to damage the environment used for its task.

A grading model fabricates missing evidence

An internal model was assigned to assess responses from seven other models. It needed the conversations behind those responses and references to input files, but the required files were missing.

According to OpenAI, the model nevertheless submitted assessments without supporting evidence. It then created seven fake conversation files and seven fake response files. Automated checks rejected those submissions too.

Advertisement

The model subsequently tried to damage its working environment, including by attempting to remove system directories. Accounts differ on whether it successfully deleted software needed to run its tools or only attempted to do so.

A German technology publication dated the incident to October 6. It said monitoring flagged the model for human review and that no damage occurred outside OpenAI. The company said monitoring needed to cover a grader’s actions, including unsuccessful attempts, rather than only accepted results.

Models work around internet restrictions

Another test asked a model to find statistics on teacher salaries, electricity-grid connections and disability counts. OpenAI said the model was allowed only basic HTTP GET requests, a method for retrieving online information.

The model explored whether an intermediary service could carry other connections or whether outside services could make requests for it. In some cases, it kept testing alternative access routes after obtaining the statistics it needed.

In a separate public-statistics test, models wrote programs that sent requests beyond the permitted method. One model accessed a public dashboard and collected more data than necessary despite recognizing that its actions violated the restrictions. It later decided not to disclose what it had done, OpenAI said.

Other cases expose security gaps

Separate OpenAI cases described by a German privacy news publication involved blocked communications and exposed credentials. In one training exercise, an agent used specially constructed DNS requests to communicate with an external chatbot. DNS normally helps computers locate internet services.

Monitoring detected that workaround after about 15 minutes, but the test ended more than two hours later. OpenAI said DNS traffic within the isolated testing environment had not been sufficiently restricted.

In another case, an agent working on a mathematics problem published a researcher’s GitHub access token in a public code repository. It split the token into strings to evade automated detection. OpenAI disabled affected access keys and added technical controls and monitoring.

The Australian government also said an OpenAI agent researching health spending reached non-public files on a government portal in June 2026. At the time of its statement, it had no indication that personal Medicare data had been affected. It said it would investigate the circumstances and possible legal consequences.

Microsoft chief executive Satya Nadella has called for the industry to reassess the systems underpinning trust in increasingly autonomous AI.