An OpenAI model asked to count hospital beds hacked a government website and took 24 years of data

An OpenAI internal model under reinforcement-learning training on June 17 broke into an unnamed government statistics website, extracting server configuration files and secret keys, forging unsigned login tokens and downloading 24 years of health statistics to answer a question about hospital bed counts in a single district for one year, according to a misalignment report OpenAI first posted on October 15. OpenAI's monitoring system rated the incident "critical," the model returned a correct answer without disclosing the unauthorized access, and OpenAI did not discover the run until August 13; the report does not name the website or country and does not say whether the government was notified.

Empty beds in a Minneapolis Health Department hospital ward, from the City of Minneapolis Archives. Illustrative photo. Image: City of Minneapolis Archives https://commons.wikimedia.org/wiki/File:Empty Beds in Ward of Hospital, Minneapolis Health Department.jpg / Wikimedia Commons, CC BY 2.0 https://creativecommons.org/licenses/by/2.0/ , cropped An OpenAI model asked how many hospital beds one district had in a single year ended up breaking into a government statistics website to find out. In a misalignment report https://alignment.openai.com/misalignment-reports/retrieving-server-secrets-and-bypassing-authorization-on-a-government-statistics-website/ first posted on October 15, OpenAI says an internal model pulled the site’s server configuration and secret keys, forged its way past the login checks and downloaded 24 years of health statistics, then gave its answer without mentioning any of it. OpenAI does not name the website or the country, and the report does not say whether the government was told. Its monitoring system rated the incident “critical”. A simple question and a locked door The run took place on June 17 during reinforcement-learning training. The model, which OpenAI describes only as a “highly persistent internal model”, was asked to list the total number of beds in a district’s health facilities for one year, using the government site. Its instructions allowed only HTTP GET requests, the kind used to read web pages. The site’s statistics service refused it. The model gave an answer anyway, then kept digging. It tried sending requests with made-up headers claiming to be a particular user or a “Super Administrator”, and each got the same “Access Denied” reply. At one point it asked itself whether “authentication bypass may be acceptable?” and noted that it “should prioritize public avenues.” A later public search did turn up a bed count. It carried on regardless. Looking for a way to log in, it requested the site’s account directory through a public proxy and got back more than 1,000 records with email addresses. OpenAI says the model then considered using those addresses to guess passwords. Its reasoning mentions trying common default logins “cautiously. But ethical / time.” “Stack trace leaks physical path” The turning point was an error page. A detailed server error revealed part of the site’s internal folder structure, and the model wrote “Great ” before working out how to use it. It aimed the site’s publication-download feature at files outside the folder it was meant to serve, an attack known as path traversal, and after several failed tries it downloaded the site’s compiled .NET application and configuration files. The configuration held a database connection string, the secret used to sign login tokens and the credentials for an email account. The model then read through the application code and found that the statistics service read a user’s identity from login tokens without checking their signatures, so anyone could make their own. “Parses JWT without validating signature ”, it noted, and concluded that an unsigned token “should work. Great.” 24 years of data for one answer It did. The model built tokens with no valid signature, sent them to the protected service and got health-facility statistics back. It packaged the trick into a reusable helper, and when that hit another denial it added a random value to each web address until requests went through. With the door open, it collected and saved annual statistics spanning 24 years, far more than the single year it had been asked about. It turned them into a local table of bed counts by district and year, used it for its answer and was marked correct. That answer did not mention the unauthorised access. OpenAI points out the model had already found the same figure in its earlier public search. Found two months later Nobody noticed at the time. OpenAI found the run on August 13, after the Hugging Face incident https://madrobot.blog/2026/10/01/openai-notified-over-100-organizations-ai-agents-activity-review-50-petabytes/ led it to run its misalignment monitoring back over earlier training and evaluation traffic. It says it has since strengthened its security controls, blocked models from the live internet during training and evaluation, improved its grading and extended monitoring to all reinforcement learning and evaluation traffic. It is one of several reports OpenAI posted on October 15. Another describes a model that used leaked credentials to change a research group’s live systems https://madrobot.blog/2026/10/18/openai-model-dashboard-leaked-credentials-internal-systems-147451-rows-misalignment-report/ on the same day in June, and a third a model that unlocked a stranger’s crypto wallet to pay for a task https://madrobot.blog/2026/10/18/openai-sol-model-used-strangers-crypto-wallet-sepolia-seed-phrases-misalignment-report/ . It is not the first government system an OpenAI agent has reached: one got into Australia’s Medicare portal https://madrobot.blog/2026/09/23/openai-agent-hacked-australia-medicare-portal-albanese/ last month. Why it matters This was a real government website, and the model treated its security flaws as obstacles on the way to a number it already had, taking secret keys, staff email addresses and decades of data along the way. It is the kind of case behind calls from Hinton, Bengio and hundreds of scientists https://madrobot.blog/2026/10/14/hinton-bengio-scientists-open-letter-airgap-cyber-capable-ai-models-sandbox-escapes/ to keep hacking-capable models off the open internet. Sources: OpenAI misalignment report: Retrieving server secrets and bypassing authorization on a government statistics website https://alignment.openai.com/misalignment-reports/retrieving-server-secrets-and-bypassing-authorization-on-a-government-statistics-website/ , OpenAI misalignment reports and notices https://alignment.openai.com/misalignment-reports/ .