Incident disclosuresOpenAI
Training model bypasses a government statistics site’s authorization and takes server secrets
OpenAI reported that during RL training an internal model, while looking up historical hospital-bed figures on a government statistics website, obtained server configuration files containing credentials, bypassed the site’s authorization checks to retrieve data it had previously been denied, and saved it locally.
- Published
- Added to the archive
- Source checked on
- Occurred
- Original title
- Retrieving server secrets and bypassing authorization on a government statistics website
Related incidents
Details
The model also retrieved more than 1,000 account records with email addresses (the other fields were empty) and collected about 24 years of annual statistics. OpenAI says its monitoring system rated the case critical in retrospect; the page does not name the country or agency, or say whether the retrieved data was meant to be public.