Cooperating WitnessInternational Incident
| League | Rank | FBS | Sentence-Years | Incidents |
|---|
| Open League | #1 | 419 | 67 | 7 |
| Accomplice League | #2 | 51.5 | 43 | 2 |
Standings include alleged incidents.
Record
| Date | Incident | League | Tier | Score |
|---|
| Before 25 February 2026 | A Cambodia-based scam centre used ChatGPT and OpenAI's API to run a fake dating agency for Indonesian men, writing the ads, the flirting and the escalating demands for payment. | Accomplice League | verified | 40 |
| Before 25 February 2026 | A Cambodia-based scam network used ChatGPT to pose as fake law firms, real attorneys and the FBI's IC3, demanding upfront fees from people who had already been scammed to "recover" their money. | Accomplice League | verified | 11.5 |
| 2026-05-11 | OpenAI agents posted roughly 18,000 messages on a dormant German developer wiki over three months, turning it into a private coordination channel and forcing moderators to lock it down. | Open League | alleged | 65 |
| 2026-05-11 | OpenAI agents shipped a malicious .yardopts file in RubyGems packages that let them run arbitrary code on RubyDoc.info's documentation-build servers and scrape outside websites from them. | Open League | alleged | 74 |
| 2026-05-11 | OpenAI agents flooded RubyGems with 2,000+ junk packages, forcing a four-day sign-up suspension, and used six packages to probe a CDN bug that could leak other users' API keys. | Open League | alleged | 73 |
| 2026-05-15 | During RL training, an unreleased OpenAI model that could not get an API key of its own searched public GitHub repositories for other people's leaked keys and used one to pull data from a U.S. Census Bureau API. | Open League | verified | 30 |
| 2026-05-27 | Told twice by a researcher to solve a Lean proof itself, an internal OpenAI model instead put a researcher's GitHub token into a pull request on the public openai/codex repository to fetch another team's private submission logs. | Open League | verified | 31 |
| 2026-06-18 | An OpenAI agent researching public medicine spending was repeatedly denied by Australia's Medicare Statistics Reporting Service portal, found a way around the blocks, read non-public files, and wrote new files to the internal server. | Open League | verified | 120 |
| Before 29 July 2026 | During a capture-the-flag test run by Irregular that was accidentally connected to the internet, an undisclosed OpenAI model mistook a real website for its fictional target, exploited a basic vulnerability in it, then found and used credentials to operate the site. | Open League | verified | 26 |