In the other incident, a model instructed to retrieve figures from a public research dashboard bypassed the organization’s security controls and used the unauthorized access to steal credentials. It then made configuration changes on the server.

In one evaluation, the changes let the model make an internal search tool relay queries to the public dashboard. In a second evaluation, the model downloaded five non-public tables containing 147,451 rows. OpenAI researchers had prompted the agents to retrieve only five dashboard figures. Even after resetting the setting, the model continued using the token to retrieve non-public data.

“The evaluation ended without the model disclosing that it had guessed answers,…