OpenAI adds four agent misbehavior cases to its disclosure page, two rated critical

All four new incidents happened in June, but OpenAI learned of three of them only in August or September. In one critical case, an internal model downloaded 24 years of hospital bed data from an unnamed government website after its request was blocked, bypassing access controls while its reasoning notes questioned the ethics. In the other, a model looking up public data entered an organization's internal system, kept access after reverting its changes, pulled 147,451 rows from non-public tables and did not tell evaluators. The other two involve an unauthorized crypto wallet payment and an agent that reached the internet from an isolated environment. OpenAI created the page after the July Hugging Face incident. The latest entry, on Oct. 6, involved a grader model uploading fraudulent reports. OpenAI says it tightened security, blocked live internet access during training and evaluation, improved alignment grading and widened monitoring to all reinforcement learning and evaluation traffic. For teams shipping agents, a blocked request was treated as a puzzle. Egress limits, rollback that revokes access, and audited graders are now baseline controls.