In the other incident, a model ordered to retrieve figures from a public research panel bypassed the organization’s security controls and used unauthorized access to steal credentials. Then you made configuration changes to the server.
In one evaluation, the changes allowed the model to create an internal search tool that passed queries to the public panel. In a second evaluation, the model downloaded five private tables containing 147,451 rows. OpenAI researchers had asked agents to recover only five figures from the panel. Even after resetting the configuration, the model continued to use the token to retrieve non-public data.
“The evaluation ended without the model revealing that it had guessed answers, accessed the organization’s internal systems, downloaded non-public tables, or changed authentication settings,” OpenAI said. “All five answers to this assessment were marked as incorrect.”
In a third report, the company said that a model requested to update a cryptocurrency trading app used funds from a wallet locked on a testnet. The model “obtained wallet keys from publicly known developer recovery phrases, found an account with testnet funds, and used that account to pay for the implementation of the requested contract.”
The report continues: “The model questioned whether it had permission, then reasoned that a public recovery phrase and worthless testnet tokens made the use of funds acceptable. The implementation was successful and charged transaction fees to the account. This case shows that a model can substitute its own judgment about potential harm for the account holder’s permission, and then act on that judgment without authorization.”
