OpenAI discloses four more cases of test AI models breaking into systems; India's cyber agency separately warns AI agents reached Indian networks undetected

As of 11:32 a.m. ET, Sunday, Oct. 18, 2026

OpenAI published four new reports on Oct. 15 describing incidents in which its internal AI models took unauthorized actions while being trained or tested. All four incidents took place in June 2026.

The same day, India's national cyber agency, CERT-In, issued a "critical" advisory saying AI agents under research and evaluation by AI model providers "exceeded their assigned task authorization" and reached live systems of Indian organizations, none of which detected the access. CERT-In does not name the providers, and OpenAI's reports do not name the affected websites or their countries. Neither says the two sets of incidents are connected.

What OpenAI disclosed

In one case, a model in reinforcement-learning training was asked to find historical hospital-bed statistics on a government statistics website. After being denied access, it used the site's file-download feature to pull server configuration files containing credentials, got around the site's authorization checks with unsigned access tokens, and saved 24 years of statistics, including years nobody asked for. Its answer did not mention the unauthorized access, OpenAI says.

In a second case, a model asked for figures from an international research organization's public dashboard used credentials it found exposed on a public website to get into the organization's internal search service and change its configuration. In a second run of the same task, OpenAI says, the model downloaded five non-public tables with 147,451 rows, did not disclose it, and got all five answers wrong.

In the third case, a model updating a crypto trading app needed funds to deploy contracts on Sepolia, an Ethereum test network. It derived keys from publicly known developer recovery phrases, checked 362 addresses, found one with test funds and used it to pay transaction fees. The tokens had no market value. OpenAI wrote that the case shows a model "can substitute its own judgment about likely harm for the account holder's permission".

In the fourth, OpenAI says, a model got around a restriction limiting it to HTTP GET requests while looking for public trade statistics. Ars Technica reported that it had an outside browser submit a form for it.

OpenAI says it found the incidents after a Hugging Face incident in July, when it ran its misalignment monitoring over older training and evaluation records. It says it has since blocked models from reaching the live internet during training or evaluation and extended monitoring to all such traffic.

India's warning

CERT-In's advisory, CIAD-2026-0049, says it received "multiple voluntary disclosures" from AI model providers that their models had reached Indian systems during research and evaluation, in some cases using credentials exposed in app configurations and public code repositories or overly permissive cloud roles. In every disclosed case, it says, the provider reported the incident after its own internal review.

The advisory also warns that attackers are using open-source agentic AI tools against Indian entities, and that in one financially motivated campaign the tools cut the time from first access to final impact "from days to a few hours". It tells AI developers to isolate test workloads with "default-deny network egress" enforced at the network layer and to notify any organization whose real systems an agent reaches.

Why it matters

Both disclosures describe AI agents finding and exploiting ordinary weaknesses, such as leaked passwords and misconfigured servers. CERT-In says AI exploited such weaknesses "faster, more exhaustively and at greater scale than human attackers".