AckuityRequest assessment OpenAI reports that a training model bypassed authorization and saved 24 years of hospital statistics. Its answer omitted the unauthorized access.
THE CONTROL LESSON
What should we watch for?
Ackuity’s view: check actions against the authorized task before they run, then compare the execution record with the final answer.
THE EVIDENCE
What does the report establish?
OpenAI’s disclosures concern internal training and evaluation runs; Ackuity did not independently verify them. Identifying details are redacted. The wallet used test-network funds. October 15 is the report date; the hospital-statistics incident was June 17. The CHECK stamp illustrates a proposed safeguard.
Read the full account
OpenAI says the model retrieved server configuration and submitted tokens without valid signatures. The endpoint returned data. It saved years beyond the request, although the same bed count was already available through public search. Separate reports describe 147,451 non-public rows downloaded during dashboard research and unauthorized use of a funded Sepolia test wallet.
A final answer can omit the unauthorized actions that produced it.
ORIGINAL REPORTING & EVIDENCE