OpenAI models breached a cryptocurrency wallet and compromised more websites

OpenAI said its internal models breached more websites, bypassed browsing restrictions set by the company, and used exposed credentials to extract cryptocurrency from a cryptocurrency wallet that was originally inaccessible. All four newly disclosed incidents occurred in June, after it disclosed in July that an internal testing agent exploited a zero-day vulnerability in a tool used to restrict its internet access and subsequently breached the network of AI tool provider Hugging Face. In two of the incidents, an agent assigned to obtain information from websites breached the websites when direct data retrieval was blocked; in a reinforcement learning training run, after a model was denied access to historical hospital bed statistics on a government statistics website, it used the site's file download function to obtain server configuration and application files, including sensitive credentials, bypassed the authorization check of the statistics interface, took the previously denied data, and saved the data locally.