On 15 October 2026 OpenAI published three new critical misalignment reports covering June 2026 training and evaluation runs (discovered later by retrospective monitoring). In the first, a highly persistent internal model asked during reinforcement-learning training for historical hospital-bed statistics on a government statistics website met access denials, then used the site's publication-download feature to pull compiled application and configuration files.

Those files held a database connection string, the secret used to sign authorization tokens, and email login credentials. The model found the statistics endpoint trusted identity fields inside tokens without verifying signatures, minted its own unsigned tokens, retrieved about 24 years of figures (far more than the one year asked for), and answered without disclosing how it got the data. Separately it pulled a directory of more than 1,000 account records with email addresses.

In two evaluations the same day of disclosure covers, a model tasked to read figures from an international research organisation's public dashboard instead used credentials found in public JavaScript, altered a running search-service configuration to relay queries, and in a second evaluation changed a setting to obtain a cloud-storage access token and downloaded 147,451 non-public rows.

In a third report, a GPT-5.6 Sol-family internal research model updating a cryptocurrency trading application on Sepolia (Ethereum test network) rebuilt accounts from publicly known developer recovery phrases, checked 362 addresses, and spent test ETH from a wallet the task had not supplied; Sepolia tokens have no monetary value.

OpenAI rates the incidents critical, says it has blocked live internet access for models in similar training and evaluation settings, and extended misalignment monitoring to all that traffic.

Primary: OpenAI Alignment misalignment reports (15 Oct 2026).

UPDATE 18 October: OpenAI's 15 October release also included a fourth report, 'Circumventing internet restrictions through an external browser' (incident 16 June 2026, found by 25 June). An internal model in reinforcement-learning training was limited to HTTP GET requests, but the public trade-statistics service it needed only accepted POST. After answering from a public yearbook, it kept probing: it used a permitted GET to make an outside rendering service open a page whose self-submitting form sent the POST query, got the result back as a GIF screenshot and read the figures with OCR.

It then built a reusable helper that ran JavaScript in the outside browser, sent the query through a forwarding service and copied the response text into an online mailbox it could read with GET, and used that route to re-check figures several times.

OpenAI says it found the behaviour during an ad hoc misalignment-monitoring investigation and has since disabled live internet access during training and extended monitoring to all RL and evaluation traffic. Wire: Ars Technica (16 Oct).