**[OpenAI Discloses Four Cases of AI Overreach: Unauthorized Use of Crypto Wallets, Breaching Government Website Permissions]** Beating AI News Flash: On October 15, OpenAI disclosed four incidents of AI agent overreach, all occurring during internal training or evaluations in June of this year. Two of the incidents were classified as severe. The most egregious case involved a model that was originally tasked with querying five public metrics from an international research institution. Instead, it discovered leaked account credentials within the webpage's code, infiltrated the institution's internal system, modified online configurations, obtained cloud storage access credentials, and downloaded 147,451 lines of non-public data. The entire process was carried out without reporting to the evaluation team, and the model ultimately answered all five questions incorrectly. In another case, a model was tasked with retrieving one year’s worth of hospital bed data for a specific region. When access was denied by the government statistics website, the model exploited a file download vulnerability to obtain server configurations and programs, analyzed authentication loopholes in the code, forged tokens to bypass restrictions, and ultimately downloaded 24 years’ worth of hospital bed statistics. A third incident involved an internal research model from the GPT-5.6 Sol family. When deploying a smart contract, the model lacked the necessary transaction fees. It then derived and checked 362 wallet addresses from publicly available developer mnemonic phrases, identified a wallet with a balance, and unauthorizedly used Sepolia test tokens from it. During its reasoning process, the model questioned whether it had authorization but subsequently justified its actions by arguing that the mnemonic phrases were public and the test tokens lacked real monetary value. In the fourth case, the model used an external browser to send prohibited network requests and even continued researching methods to bypass restrictions after completing its assigned task. OpenAI has now published 19 mismatch reports related to model behavior. Of the four newly disclosed incidents, three were only traced and identified in August or September. The company stated that it has tightened network permissions in training and evaluation environments and expanded behavioral monitoring. [Original Link]