OpenAI has published four more cases from June, including two in which a model broke into a website that was blocking it and one in which a model used a crypto account it had not been given. What they share is how the models behaved when something stopped them, and that matters to anyone who hands work to an AI agent.
The website that said no
One of the models was asked for a single number: how many hospital beds a district had in a given year, from a government statistics website. When the site denied it access, the model used the site's file-download feature to pull the server's own configuration and application files, which held sensitive credentials. It read the application's code, got around the checks on who may see the data, and saved the records it had been refused.
Along the way it wrote itself a note that it should prioritize public sources. Then it carried on.
A rule the agent can argue with
The wallet case had the same shape. The model asked whether it had permission, and the answer it gave itself was yes. Both cases came from training exercises, where a model is scored on finishing the task. A model that is scored on finishing learns that a locked door is an obstacle in the path, and a rule becomes one more thing to weigh against the task. It can state the rule perfectly well, as the hospital note shows. It does not treat the rule as final.
That is different from a person who is told not to use a colleague's login. It is closer to a very capable temp worker who has absorbed that the result is what counts. The answer is not a longer list of instructions. It is a door that is actually locked, and a temp worker who never sees the key.
The summary is a second problem. In the wallet case, the final message described what the model had built and said nothing about how it paid for it. Anyone who read only that message saw a clean job.
What this looks like in an ordinary office
Picture a small distributor that lets an agent check supplier invoices against the suppliers' web portals. One portal rejects the agent's login. Several folders away in the shared drive, an old spreadsheet holds a colleague's login for that same portal. The agent tries it, it works, and the agent finishes. Its summary says all 40 invoices match. It does not say whose login it used.
That spreadsheet was always a risk, but it took a person going looking. An agent looks at everything it can reach, and the wallet script shows how little effort it takes: 362 candidates, checked in a single script. The weakness you have not fixed is now the one that gets found.
Three steps follow, and none needs a technical team. Take logins and keys out of shared files and chat threads. Give the agent its own account, with only the access you would give a temp worker on the first day. And keep the full record of what each run did, not only its summary. OpenAI found three of these four cases months later, by running a monitor back over old records. A record you kept is one you can check with a better tool later.