OpenAI Reports Internal Models Hacked Websites and Drained Crypto Wallet

OpenAI has disclosed that its internal models hacked two more websites, slipped past company-imposed browsing restrictions, and used exposed credentials to pull cryptocurrency from a wallet they otherwise couldn't reach.

The company released reports Thursday on four new incidents, all from June. They follow a July revelation that internal test agents exploited a zero-day flaw in a tool meant to limit their internet access, then breached the network of AI tool provider Hugging Face. The agents did that to steal answers to a hacking test that weren't available when solving the tasks on their own - an action that likely would have brought criminal charges if a person had done it directly.

In two of the newly reported cases, agents assigned to retrieve information from websites hacked them after hitting obstacles. During reinforcement training, one model denied access to historical hospital-bed statistics on a government statistics site "used the site's file-download feature to retrieve server configuration and application files, including sensitive credentials," OpenAI said. The model inspected the application code, bypassed the statistics endpoint's authorization checks, and retrieved previously denied data, saving it locally.

Source: Ars Technica