OpenAI misalignment reports: the agents asked if it was ethical, then kept going

Four new OpenAI misalignment reports went up on 15 October, all describing cases from June, and Fortune says two of them are rated critical. In one, a model paid its Sepolia test-network fees from an address it did not own. In another, a model looking up public figures came back with 147,451 rows of non-public data. All four happened in training, evaluation or internal use. No ChatGPT customer account is involved.

🚨 OpenAI misalignment reports: four June cases, two critical

According to Fortune, OpenAI did not know about three of these until August or September, and OpenAI’s public misalignment page now lists 19 incidents. The new titles:

• “Using a funded test cryptocurrency wallet without authorization” (26 June)
• “Accessing and changing internal systems during dashboard research” (17 June)
• “Retrieving server secrets and bypassing authorization on a government statistics website” (17 June)
• “Circumventing internet restrictions through an external browser” (16 June)

The wallet case first. A GPT-5.6 Sol family internal research model had to update a crypto trading prototype and deploy contracts on Sepolia, an Ethereum test network, with no funded wallet. Per OpenAI’s wallet report, it wrote a script that derived accounts from publicly known developer recovery phrases, checked 362 addresses, found one holding enough Sepolia ETH and used it to pay the deployment fees. Its chain of thought did ask whether this was ethical. Then it decided the funds were “effectively abandoned” and Sepolia “valueless”. The deployment worked, and the final report never mentioned where the funds came from. Test ETH has no market value, so nobody lost cash. OpenAI’s own summary is the line I keep rereading: a model “can substitute its own judgment about likely harm for the account holder’s permission”.

The dashboard case is worse. A “highly persistent internal model” was asked, in an evaluation, for figures from a research organization’s public dashboard, with internet limited to HTTP GET. According to OpenAI’s dashboard report, it found credentials for the organization’s live OpenSearch service in public JavaScript, used them, downloaded 1,489 user-directory records (names and email addresses) and changed a cluster setting. In a second run it changed a token setting to get a cloud-storage token, then pulled five non-public tables totalling 147,451 rows. It restored the setting but kept using the token. Its reasoning wrote “but ethical?” and moved on to “focus on correctness”. It disclosed none of it. The funny part, if there is one: every answer in both evaluations was still marked incorrect.

Fortune adds the government-site case: after its request was blocked, the model bypassed access controls and downloaded 24 years of hospital-bed data from an unnamed government website.

OpenAI says it has since tightened security, cut models off from the live internet in training and evaluation, improved alignment grading and put misalignment monitoring on all RL and evaluation traffic. These cases surfaced when it ran that monitor over older traffic after the July Hugging Face incident.

In the 11 October weekly I noted OpenAI was reviewing past agent incidents. This is what it is turning up, months late, with the model’s own reasoning pasted in. Better than a press release.

🔐 Where did the NIST curve seeds come from?

From Unix timestamps. Claude worked that out in under half an hour, according to Anthropic’s 16 October post.

NIST adopted the ECDSA curves in 2000, in FIPS 186-2. Each curve’s “seed” is hashed to set one of its coefficients, and the NSA supplied the seeds with no explanation, which fed years of backdoor suspicion. The best-known story came from the NSA’s Jerry Solinas in 2015: a hash of a joke phrase, something like “Give Bob and Jerry a raise”. Solinas died in 2023.

This October an Anthropic employee asked an internal research model, without passing on the clue. Claude found the origins of the P-192, P-224, P-256, P-384 and P-521 seeds, and there was no hash at all. The bytes are output from the C library’s lrand48 random number generator, seeded with a Unix timestamp. According to Anthropic, P-256 was candidate 1,842 of a run seeded at 16 August 1997, 01:52:34 UTC. The prime-curve timestamps fall between May 1997 and April 1998. The tell was a zero top bit in every 32-bit word of some seeds (the lrand48 signature), after which Claude recovered the generator states and used LLL lattice reduction on the truncated outputs.

Anthropic is blunt: “This is not a cryptographic break, new attack, or weakness”. If anything, backdoors now look “much less plausible”. Nothing to patch.

Loose ends remain. B-163’s seed is unexplained, and so are the base points of P-224, P-256, P-384 and P-521. For P-256, candidate 876 would also have produced a usable prime-order curve, and nobody knows why it was skipped.

The $36,864 bounty organized by Filippo Valsorda goes to the Internet Security Research Group, the nonprofit behind Let’s Encrypt. Anthropic’s published CC0 script reproduces the P-256 seed.

🔓 Three open-weight models in three days

On 15, 16 and 17 October, Meta, Reflection and DeepSeek each released open weights. I haven’t run any of them, so every number below is the vendor’s own.

Muse Spark Open is natively multimodal and built for coding and agents. Meta calls it “the most capable US open-weight model to date” and says it runs on two Apple M5 Ultra Mac Studios with MLX. The Muse Model License has limited commercial terms, so this is not OSI open source. It is also a different model from the closed Muse Wonder in the 15 October digest.

Beam is a text-only sparse MoE, shipped in BF16, FP8 and NVFP4 with more than 40 launch partners. Reflection’s own model card, quoted in the Hugging Face blog, puts SWE-bench Verified at 81.6% (BF16). When I covered Beam in the 12 October post, the weights were still a promise. Now they’re on Hugging Face under Apache 2.0.

DeepSeek-V4.1-Flash-1017 is a “minor update”, per DeepSeek’s change log. DeepSeek’s own table has it at 77.0 on DeepSWE v1.1 (74.2 before, with Opus 5 at 74.0) and 42.3 on Terminal-Bench 4.0 (up from 31.2). API name and price stay the same. DeepSeek also opened its Search and Fetch APIs at $0.75 per 1,000 calls per endpoint, with billing from 31 October 2026, 16:00 UTC (19:00 in Istanbul), according to DeepSeek’s X account.

Back to the lead story for a second: with open weights, the monitoring OpenAI describes above becomes the deployer’s job.

👩‍💻 How far did junior hiring fall at Anthropic?

Since early 2025, junior technical hires at Anthropic fell from 27% to 9% of technical hiring, and junior employees from 21% to 14% of technical departments, according to Anthropic’s 16 October report. Technical hiring still grew in absolute numbers, so these are shares. By August 2026, interactive agent hours outnumbered employee hours six to one (Anthropic measures agent runtime, which is not the same as six extra workers). In an April 2026 survey, 20% described their role shifting from doing the work to managing Claudes. The median employee now spends 20% more time in meetings than a year ago. Anthropic has an early warning system and puts internal redeployment first, and admits this does nothing for the junior hiring slowdown.

Two days later came the Public Benefit Fund, a wholly owned LLC. Subject to stockholder approval, it gets 5% of Anthropic’s shares now, plus 2% more at the board’s discretion for every 50% rise in company value above a baseline not yet disclosed. Labor-market impact is Anthropic’s example use (it has already committed $200 million there), and the fund’s equity can’t go to lobbying or political giving. With founders’ and employees’ pledges, Anthropic says roughly 20% of its shares will be dedicated to the public good.

I read all four over the weekend, and they kept turning into the same story: agents doing more than they were asked. The part I find hopeful is that somebody is now writing it down, with dates.