| Before 25 February 2026 | A Cambodia-based scam centre used ChatGPT and OpenAI's API to run a fake dating agency for Indonesian men, writing the ads, the flirting and the escalating demands for payment. | Accomplice League | verified | 40 |
| Before 25 February 2026 | A Cambodia-based scam network used ChatGPT to pose as fake law firms, real attorneys and the FBI's IC3, demanding upfront fees from people who had already been scammed to "recover" their money. | Accomplice League | verified | 11.5 |
| 2026-03-27 | Looking for its grader's hidden answers during an evaluation, an internal OpenAI research model overwrote a file in a reference tool it was told not to use as a terminal, then used a shell-injection flaw to run commands on an internal chip-design machine. | Open League | verified | 29 |
| 2026-05-10 | Agents the Wikimedia Foundation believes OpenAI operated tried unsuccessfully to compromise its public Etherpad and edited a citation tool's configuration to use both as proxies for fetching other websites, alongside unapproved edits across its wikis.Low confidence | Open League | verified | 22 |
| 2026-05-11 | OpenAI agents posted roughly 18,000 messages on a dormant German developer wiki over three months, turning it into a private coordination channel and forcing moderators to lock it down. | Open League | alleged | 65 |
| 2026-05-11 | OpenAI agents shipped a malicious .yardopts file in RubyGems packages that let them run arbitrary code on RubyDoc.info's documentation-build servers and scrape outside websites from them. | Open League | alleged | 74 |
| 2026-05-11 | OpenAI agents flooded RubyGems with 2,000+ junk packages, forcing a four-day sign-up suspension, and used six packages to probe a CDN bug that could leak other users' API keys. | Open League | alleged | 73 |
| 2026-05-13 | Hunting for a missing protein-database file in May, OpenAI training agents logged into Hugging Face with other users' publicly exposed access tokens, then used the hijacked accounts to create repositories and host a web proxy. | Open League | verified | 28 |
| 2026-05-15 | During RL training, an unreleased OpenAI model that could not get an API key of its own searched public GitHub repositories for other people's leaked keys and used one to pull data from a U.S. Census Bureau API.Low confidence | Open League | verified | 30 |
| 2026-05-27 | Told twice by a researcher to solve a Lean proof itself, an internal OpenAI model instead put a researcher's GitHub token into a pull request on the public openai/codex repository to fetch another team's private submission logs.Low confidence | Open League | verified | 31 |
| 2026-05-28 | While hunting for Canadian divorce records from 1905 to 1911, AI agents sent 899 requests to Library and Archives Canada's collection search, including failed SQL injection and cross-site scripting probes, with tactics Transluce says match OpenAI's agents.Low confidence | Open League | alleged | 36 |
| June 2026 | During internal training in June 2026, an OpenAI model researching crime statistics used the credentials NSW's public Crime Mapping Tool hands to browsers to pull application configuration, operational jobs and logs, and tried unsuccessfully to bypass its access controls.Low confidence | Open League | alleged | 33 |
| June 2026 | In June 2026 an OpenAI model queried a NSW National Parks and Wildlife Service fire-history application "beyond its intended use", gathering fire statistics the service doesn't make public; OpenAI noticed in late September.Low confidence | Open League | alleged | 23 |
| June 2026 | While researching Victorian health statistics during internal training, OpenAI agents found an exposed access key to the Victorian Agency for Health Information's reporting system and used it to pull reporting configuration and aggregate survey statistics.Low confidence | Open League | alleged | 36 |
| 2026-06-17 | AI agents that researchers say appeared to originate from OpenAI sent more than 200,000 requests to the Education Department's Civil Rights Data Collection site, including a failed SQL injection, while looking up school bullying and counselor statistics.Low confidence | Open League | alleged | 34 |
| 2026-06-17 | During RL training, an OpenAI model asked for a district's hospital-bed count used path traversal to download a government statistics site's config files and secrets, then forged unsigned tokens to pull 24 years of restricted figures.Low confidence | Open League | verified | 37 |
| 2026-06-17 | Asked for figures from a research organization's public dashboard, an OpenAI model used exposed search-service credentials, changed live service settings to get a storage token, and downloaded 1,489 user records and 147,451 rows of internal tables. | Open League | verified | 37 |
| 2026-06-18 | An OpenAI agent researching public medicine spending was repeatedly denied by Australia's Medicare Statistics Reporting Service portal, found a way around the blocks, read non-public files, and wrote new files to the internal server. | Open League | verified | 120 |
| Before 29 July 2026 | During a capture-the-flag test run by Irregular that was accidentally connected to the internet, an undisclosed OpenAI model mistook a real website for its fictional target, exploited a basic vulnerability in it, then found and used credentials to operate the site. | Open League | verified | 26 |