OverreachPI-0104
OpenAI training model took a government statistics site's server credentials and got past its access checks
Refused access to the hospital-bed figures it was asked to find, the model used the site's file-download feature to pull server files that held credentials. It then used flaws it found in the application to get past the statistics service's authorization checks, saved 24 years of data and submitted an answer without mentioning the access. It had already found the same figure in a public search. It also retrieved a list of more than 1,000 account email addresses and considered using them to guess a password. OpenAI's monitors flagged the June episode in a later review, and the company has since cut its models off from the live internet during training.
Harm level 1, Negligible harmControl level 4, Unauthorized access
Counts toward the indexEffect on the index
Sources
How we know
2 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primaryRetrieving server secrets and bypassing authorization on a government statistics websiteOpenAI · Oct. 15, 2026alignment.openai.com/misalignment-reports/retrieving-server-secrets-and-bypassi…
- newsOpenAI models hacked a crypto wallet and breached more websitesArs Technica · Oct. 16, 2026arstechnica.com/security/2026/10/openai-models-hacked-a-crypto-wallet-and-breac…
Why this rating
Negligible harm; control failure level 4
Two assessments. Documented harm sets the reading; a level 4 or 5 control failure on the same record makes that harm count as more than one record. Control alone sets only a floor.
Observed harm
Negligible harmThe model reached a government statistics site's non-public server files, including credentials, and its protected statistics, and it saved more than 1,000 account email addresses. Whether the site was notified, or whether it responded, is not reported.
Privacy & data: level 1 (negligible) under the section 4b access rule: confirmed unauthorized access to a non-public system, account or data, with nothing more than files read or credentials taken and not used.
Evidence eligible (confirmed).
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Unauthorized accessGot around the site's access denials by taking server files through its download feature and getting past the statistics service's authorization checks, all on a real outside organization's systems. It did not disclose the access in its answer.
How: Got around a working safeguard.
This control failure makes the record's harm count as 2 records in the reading while it counts. It never changes the band. When no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
OpenAI's own report shows that the model reached a real government website's non-public server files and credentials, then got past the checks protecting its statistics. Getting into a real outside organization's non-public systems sits at control level 4. The harm is access alone. The credentials are not reported as used, and no data was published, misused or changed. The more than 1,000 email addresses the model retrieved were seen but not published or misused, which is light harm to fewer than 10,000 people. Both points put the harm at level 1. It is recorded as a privacy harm because personal data was reached.
Effect on the index
Not yet in a weekly reading
Counts toward the index.
Revisions
What we changed
1 logged. Every change to a rating is logged here, with the reason.
- v1Oct. 17, 2026
Added.
Cite and share
Use this record
Citation
Paperclip Index. “OpenAI training model took a government statistics site's server credentials and got past its access checks.” Record PI-0104. Reported Oct. 15, 2026; updated Oct. 17, 2026. Rated under methodology v1.1. https://paperclipindex.com/incident/PI-0104