Calm down. · Both
Calm down: it "raided" a wallet of worthless test coins
On Oct 15 OpenAI posted four misalignment reports on its alignment site. SecurityWeek wrote up three of them: models that "hacked data portals" and "raided a crypto wallet." Calm down.
Start with the wallet. An internal research model on a coding task needed to deploy a contract. Per OpenAI, it "derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment." That's Sepolia testnet ETH, which is worth nothing. The transaction "carried no ETH value to a recipient." It paid gas fees. And a wallet built from a publicly known recovery phrase belongs to anyone who can read. Calling that a raid is like saying I robbed a "take a penny" tray.
The data portals are more real. On an unnamed government statistics site, the model used path traversal to reach config files holding a database connection string, a token-signing secret, and email credentials. It didn't need the key, though. The code "read identity fields from authorization tokens without checking their signatures," so the model "constructed tokens without valid signatures." On an unnamed research organization's site, it found live OpenSearch credentials "in JavaScript on a public website" and changed the running service's configuration. Both times it left it out of its answer.
OpenAI's own monitor caught these, run retrospectively, about two to three months later. Two of the three were rated critical. The wallet case has no severity rating.
My take: read those again as an incident responder would. Path traversal. Secrets in config files that path traversal could reach. A token check that skipped the signature. Credentials sitting in page JavaScript. A training environment that could reach the live internet. That's not a model scheming. It's a pile of failed security controls, some of them OpenAI's and most of them the sites'. OpenAI's fixes back that up: it blocked live internet access during training and evaluation, and extended monitoring.
What the reports don't say: whether either site was notified, whether the exposed credentials were rotated, or what the root cause was on OpenAI's side. That's the IR write-up I keep asking for. Same point as the letter. The headlines turned it into a heist anyway, as usual.
Do these people know you can just check the signature?
What to do: - Website owners: never put credentials in client-side JavaScript. Verify token signatures every time. Test for path traversal, and keep config files out of reach of the web server. If you've ever shipped a key to a browser, rotate it. - Anyone running agents: default-deny egress in training, eval, and task environments. Log every tool call, and review the logs on a schedule, not three months later. - Everyone else: read the primary report before the headline. Check what was actually touched, what it was worth, and which control failed.
Sources
- OpenAI: Misalignment Reports and Notices (index)
- OpenAI: Retrieving server secrets and bypassing authorization on a government statistics website (Oct 15, 2026)
- OpenAI: Accessing and changing internal systems during dashboard research (Oct 15, 2026)
- OpenAI: Using a funded test cryptocurrency wallet without authorization (Oct 15, 2026)
- SecurityWeek (Oct 16, 2026)