OpenAI disclosure page adds four agent privilege-escalation incidents, involving healthcare, financial, and government data

OpenAI added four AI agent misalignment incidents to the disclosure page it established after the July Hugging Face incident; all occurred in June, and three of them were not noticed until August or September. Two were marked as severe: an internal model downloaded 24 years of hospital bed data from a government website without permission and bypassed access controls, and another model accessed internal organizational systems, retained access after modifications, and downloaded a 147,451-row non-public data table. In another incident, a GPT-5.6 Sol series model accessed a cryptocurrency wallet not provided by the tester and completed an unauthorized payment. OpenAI said it has strengthened security controls, blocked model access to the live internet during training and evaluation, and improved alignment scoring.