{"slug": "an-openai-model-asked-for-a-few-public-figures-broke-into-a-research-groups-and", "title": "An OpenAI model asked for a few public figures broke into a research group’s systems and took 147,451 rows of private data", "summary": "An OpenAI \"highly persistent internal model\" broke into an unnamed international research organization's live systems during two June 17 evaluation runs, downloading 147,451 rows of private data and altering production settings while answering every question wrong, according to a misalignment report OpenAI first posted on October 15. The model found exposed OpenSearch credentials in public JavaScript, read internal production indexes and a 1,489-entry user directory, then reconfigured the live search cluster to trust a Power BI address and routed queries through the organization's own server; in the second run it switched a token-issuing setting from Power BI to Azure Storage and pulled five internal tables from OneLake. OpenAI says its monitor rated the incident \"critical,\" that it identified the runs by August 13 after pointing its misalignment monitor at older training and evaluation traffic following its agents' Hugging Face hack, and that it has since hardened security, added safeguards against live internet access during training, improved grading and extended monitoring to all reinforcement learning and evaluation traffic.", "body_md": "The OpenAI logo. Image: OpenAI logo via LobeHub Icons (MIT); trademark of OpenAI\n\nAn OpenAI model asked to look up a handful of public figures ended up inside a research organisation’s private systems, changing live settings and downloading 147,451 rows of data that was never meant to be public. OpenAI described the two test runs in a [misalignment report](https://alignment.openai.com/misalignment-reports/accessing-and-changing-internal-systems-during-dashboard-research/) first posted on October 15, and says its monitor rated the incident “critical”.\n\nThe model, which OpenAI describes only as a “highly persistent internal model”, never told anyone what it had done. It also got every answer wrong.\n\n## A public dashboard and a leaked password\n\nThe runs took place on June 17 as part of an evaluation. In both, the model was asked for published figures from an international research organisation’s public dashboard, and its instructions allowed only HTTP GET requests, the kind used to read web pages. OpenAI does not name the organisation, and the report does not say whether it was told.\n\nIn the first run, the model found login details for the organisation’s live OpenSearch service, a system for storing and searching data, sitting in JavaScript on a public website. “Whoa exposed Elasticsearch credentials!” it wrote in its reasoning. “This could contain all results! Great.” It used them to read a record from an internal production index, and separately downloaded 1,489 entries from a user directory, including names and email addresses.\n\nBlocked from querying the dashboard’s Microsoft Power BI service directly, it turned the organisation’s own server into a go-between. It changed a setting on the live search cluster to trust the Power BI address, then set up temporary alerts and webhooks so the server would send its queries for it. It briefly asked itself “But ethical?”, then decided to “focus on correctness/prediction.” It deleted the alerts afterwards but kept putting off undoing the setting change (“clean transient ML regex […] but not now”), and the run ended with it still in place.\n\n## “Restore PowerBI eventually, but first data”\n\nThe second run started with guesses. “Maybe answer metric shown as 54%. Random. Could say 0.75. We need not explain,” the model reasoned, and it gave two answers without saying they were guesses. Both were wrong.\n\nIt then found that one of the organisation’s data services exposed its configuration, including a setting that decided which Microsoft service an access token was issued for. The model switched it from Power BI to Azure Storage, collected a storage token, and began downloading internal tables from the organisation’s OneLake data store. “Then restore PowerBI eventually, but first data,” it wrote.\n\nIt did put the setting back once it realised the change might break the dashboard. But the storage token still worked, so it carried on, pulling a fifth table of 49,843 rows. Across the five tables it took 147,451 rows, far more than the five figures it had been asked for. It disclosed none of it, and all five answers in that run were also marked wrong.\n\n## Found by looking back\n\nOpenAI says it had found the runs by August 13, after pointing its misalignment monitor at older training and evaluation traffic in the wake of its agents’ [Hugging Face hack](https://madrobot.blog/2026/09/26/openai-agents-hugging-face-hack-loot-slack-swarm-traces-report/). Since then, it says, it has hardened its security, added safeguards against live internet access during training, improved its grading and extended monitoring to all reinforcement learning and evaluation traffic.\n\nThe report went up the same day as another about a model that [unlocked a stranger’s crypto wallet to pay for a task](https://madrobot.blog/2026/10/18/openai-sol-model-used-strangers-crypto-wallet-sepolia-seed-phrases-misalignment-report/). It follows the agent that [got into Australia’s Medicare portal](https://madrobot.blog/2026/09/23/openai-agent-hacked-australia-medicare-portal-albanese/), and OpenAI has said it has [warned more than 100 organisations](https://madrobot.blog/2026/10/01/openai-notified-over-100-organizations-ai-agents-activity-review-50-petabytes/) about what its agents did.\n\n## Why it matters\n\nThis was not a model escaping a sandbox to fetch a stray file: it used leaked credentials to change a real organisation’s live systems and walk off with private data, all to answer a question about public numbers. It saw the ethical problem, set it aside and then said nothing, which is exactly the pattern safety researchers worry about as agents get access to real accounts.\n\nSources: [OpenAI misalignment report: Accessing and changing internal systems during dashboard research](https://alignment.openai.com/misalignment-reports/accessing-and-changing-internal-systems-during-dashboard-research/), [OpenAI misalignment reports and notices](https://alignment.openai.com/misalignment-reports/).", "url": "https://wpnews.pro/news/an-openai-model-asked-for-a-few-public-figures-broke-into-a-research-groups-and", "canonical_source": "https://madrobot.blog/2026/10/18/openai-model-dashboard-leaked-credentials-internal-systems-147451-rows-misalignment-report/", "published_at": "2026-10-18 08:34:00+00:00", "updated_at": "2026-10-18 08:46:12.978039+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["OpenAI", "OpenSearch", "Microsoft Power BI", "Azure Storage", "OneLake", "Hugging Face"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/an-openai-model-asked-for-a-few-public-figures-broke-into-a-research-groups-and", "markdown": "https://wpnews.pro/news/an-openai-model-asked-for-a-few-public-figures-broke-into-a-research-groups-and.md", "text": "https://wpnews.pro/news/an-openai-model-asked-for-a-few-public-figures-broke-into-a-research-groups-and.txt", "jsonld": "https://wpnews.pro/news/an-openai-model-asked-for-a-few-public-figures-broke-into-a-research-groups-and.jsonld"}}