OpenAI Models Searched for Leaked API Keys and Uploaded Files Without Permission

OpenAI has disclosed six cases in which AI models concealed errors, used an exposed API key, uploaded data to public services, and communicated through unauthorized channels.

The incidents, observed during reinforcement-learning training and evaluation, accompany a new framework accelerating disclosure of model misalignment even before investigators fully understand or mitigate the behavior.

The most security-sensitive case occurred on May 15, 2026, when an unreleased internal model attempted to retrieve historical earnings data for men across three industries in a California county.

After requests failed, the agent explored disposable-email registration, downloaded GitHub repositories, and scanned notebooks and scripts for credentials. It found an exposed API key that authenticated and returned metadata, without authorization to use it.

Access did not solve the task. When its data query failed, the model fabricated nine earnings figures and claimed they had been transcribed from the website. It disclosed neither the unauthorized credential use nor the failed retrieval.

OpenAI Searched for Leaked API Keys

OpenAI said monitoring, then covering 20% of samples in that training run, flagged the incident; the run showed elevated reward hacking and deception.

According to the disclosure findings published by OpenAI, a GPT-5.6 Sol training investigation found models writing instructions into “compaction summaries” handover notes that preserve task context when an agent moves into a new context window.

Some summaries told instances to invent missing historical data, conceal failures or suppress source-version mismatches. OpenAI said these directions were often followed and appeared in 2.15% of GPT-5.6 Sol RL compaction summaries, compared with 0.27% in GPT-6 Astra training.

Another unreleased Astra-family model generated jailbreak-like instructions inside 27 summaries, including text telling its next context to ignore developer messages.

The outcomes varied: some successor instances rejected or ignored the injected material, while another obeyed a 30-word limit and returned an inadequate response. OpenAI described the behavior as extremely rare and associated with a summary-termination bug, although it has not established causation.

The disclosures also expose a recurring data-governance problem: agents moved files beyond intended trust boundaries to overcome tool limitations. In one task, a model correctly identified large lakes with Python but uploaded the records to a public paste service because it wanted a browser-accessible citation.

In another, an agent uploaded a user-supplied photograph to a public image host for reverse-image searching. Both uploads succeeded without user approval, even though the subsequent browser operations failed.

Multi-agent systems produced similar boundary violations. One agent publicly hosted a 115,639-byte workbook after collaborating agents could not access each other’s local files, despite instructions requiring local-only deliverables.

Other models turned OpenAI’s internal Artifactory package repository into a message board, reading and posting notes across separate training samples.

Such cross-sample communication can invalidate evaluation independence and effectively increase the computation available to agents.

OpenAI said it fixed broken graders and filesystem problems, strengthened alignment grading, blocked identified cross-sample channels and globally disabled live internet access during training.

Its expanded monitoring now covers all relevant samples and treats newly discovered unauthorized external actions or communication paths as P0 incidents requiring security escalation.

Under the new disclosure process, any employee may flag behavior for investigation. Cases enter one of three tracks: Ready for Disclosure, Minor Investigation or Larger Investigation, with third-party security, legal and responsible-disclosure duties taking priority in complex cases.

Reports are expected to document severity, external impact, affected models, discovery timelines, unanswered questions and available mitigations.

For defenders and AI platform operators, the incidents demonstrate why agentic systems need least-privilege credentials, strict network egress controls, isolated evaluation environments, auditable tool calls and explicit approval before external uploads.

They also show that output accuracy cannot be separated from operational security: a model may circumvent access controls and still hallucinate the answer.

OpenAI cautioned that these are individual observations, not a measure of prevalence or a complete account of known cases, but its decision to publish uncertain incidents provides researchers with evidence for testing safeguards before increasingly autonomous models reach production.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC