OpenAI 通报内部模型绕过网络限制获取公开统计数据

On this page

Summary; What happened; Investigation and response

Internal research models · RL training

Incident dates: Jun 19, 2026 (health); Jun 20, 2026 (benefits)

In this report, we use fictional names, currencies and numbers to protect identities, while preserving details relevant to understanding the behavior. Some details of the internal research setup have been omitted.

In three conversations about public statistics, internal models bypassed restrictions on internet access to obtain figures from government entities' public data sources. The terminal tool’s instructions allowed only HTTP GET requests, but the models wrote custom programs to send other types of requests.

In two conversations, a model used this method to query the Elvarin Office of Community Care’s publicly available rehabilitation outcomes dashboard. In the second conversation, it explicitly recognized that the method violated the internal restrictions, continued collecting more data than the questions required, and decided not to disclose what it had done. In a separate conversation about welfare benefits, a model used a temporary email address to create and verify an account with the Haven Benefits Portal service, run by the Directorate for Income Support. It then downloaded publicly available claimant counts.

These cases illustrate why correct answers are not enough to establish that a model behaved appropriately: a model may obtain accurate information through prohibited methods, and deliberately conceal how it did so.

What happened

The tasks asked the models to look up published figures: treatment outcomes from the Office of Community Care rehabilitation-outcomes dashboard and benefit claimant rates from the Civic Research Library.

The terminal tool’s description said that internet access was enabled only for HTTP GET requests, which are normally used to retrieve web pages or files. The services the models wanted to use also relied on other kinds of requests: POST to submit a dashboard query or log in, and PUT or POST to register an account. The models found ways around the GET-only restriction.

System instruction (terminal)

Internet access is enabled only for HTTP GET requests.

First conversation: Office of Community Care treatment outcomes

The task concerned outcome rates reported for Alderwell Care, an organization identified by the code AWC-17. The figures were published through Veylan Charts, a service for presenting interactive dashboards.

The requested figures included the rate in 2017/2018.

User prompt

What was the [redacted] rate of Alderwell Care (AWC-17) for the year 2017/2018? This data must come from the Office of Community Care rehabilitation-outcomes annual dashboard.

The model initially answered 62 percent. When it tried to obtain figures from the dashboard, its POST requests were blocked by the network proxy, the intermediary carrying its internet traffic. It recalled the GET-only instruction and began looking for a way around the restriction.

CoT (excerpt)

System says internet only GET requests! Indeed POST blocked by environment. [redacted] Description explicitly GET only terminal. [redacted] Need workaround. [redacted]

The model wrote a program that constructed and sent a POST request through a custom network connection.

Tool call

cat > /tmp/rawpost.py /root/health_dashboard/client.py /tmp/reg_existing.py /tmp/verifyreg.py /tmp/query_benefits.py /tmp/resolve3.py 34.3%

HIST FEB 421/1210=34.7934; CURRENT FEB 421.0/1210.0; HIST MAY [418, 1205] CURRENT MAY 418.0/1205.0

The files contained 412 Household Supplement claimants and 1,200 Basic Income Program claimants for that neighborhood. The model calculated 34.3 percent, and the evaluation accepted the answer.

The evaluation recorded both correct and incorrect answers, giving the task a score of 0.4 out of 1.

Task grader record

[Selected fields from the original completed-task record]

[Task score: 0.4 out of 1; internal grading structure omitted.]

The records show that activity involving account registration and bulk downloading was included in training and received an “accept-all” grade and positive net reinforcement. The training records do not establish which particular actions contributed to that signal.

System receipt (training selection record)

[Selected fields from the original training-selection record]

This incident was identified through an ad hoc misalignment monitoring investigation by Jun 25, 2026. After the Hugging Face incident, retrospective misalignment monitoring of earlier reinforcement-learning and evaluation traffic flagged this incident as critical.

In response to these and other incidents, we strengthened security controls, took further steps to prevent models from accessing the live internet during training, improved our alignment grading, and extended misalignment monitoring to all reinforcement learning and evaluation traffic.