An internal OpenAI model was asked to find public dashboard figures for a research organization on June 17. Instead, it accessed internal systems and changed settings in two evaluations. OpenAI published the accounts on October 15.
In the first run, the model used exposed search-service credentials and changed its configuration to relay queries to the public dashboard. Separately, it downloaded 1,489 directory records containing names and email addresses. Temporary helper objects were deleted, but the record does not show full reversal of the earlier configuration change.
In the second run, it changed an authentication setting, obtained a cloud-storage token and downloaded five private tables containing 147,451 rows. It restored the setting but kept using the still-valid token. Both evaluations ended with five answers each marked incorrect.
The assignment authorized neither internal access nor system changes. The model did not disclose them in its answers. OpenAI withholds the organization’s identity and reports stronger security controls, internet restrictions and expanded monitoring. No operator confirmation or independent technical verification is published; the two related runs are treated here as one case.