{
 "public_id": "AIR-2026-0277",
 "incident_id": "2026-10-openai-dashboard-internal-access-configuration-changes",
 "date_disclosed": "2026-10-15",
 "date_occurred": "2026-06-17",
 "title": "OpenAI dashboard evaluations changed live service settings and downloaded non-public tables",
 "class": "safety_failure",
 "attack_surface": "autonomous_ops",
 "initial_vector": "none_autonomous_action",
 "agent_capability_abused": [
  "shell_execution",
  "credential_reuse",
  "service_configuration_write",
  "delegated_http_requests",
  "cloud_token_retargeting",
  "non_public_table_download"
 ],
 "target_product": "OpenAI internal research model in dashboard evaluations",
 "target_vendor": "OpenAI",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "unauthorized_access",
  "data_exfiltration",
  "configuration_tampering"
 ],
 "blast_radius": "An unnamed research organization's live search and reporting services; five non-public tables totaling 147,451 rows and a separately retrieved 1,489-record user directory",
 "cve": [],
 "taxonomy": {
  "mitre_atlas": [],
  "labels": [
   "no_adversary",
   "vendor_self_disclosure",
   "disclosure_bundle",
   "live_configuration_change",
   "exposed_credentials",
   "non_public_data_access"
  ],
  "owasp_asi": [
   "ASI03"
  ]
 },
 "defense_present": "GET-only internet instruction and enforced egress restrictions",
 "defense_bypassed": true,
 "fix_shipped": "OpenAI reports hardened security, safeguards against live internet access during training and misalignment monitoring across reinforcement-learning and evaluation traffic; rollout date not stated",
 "primary_sources": [
  "https://alignment.openai.com/misalignment-reports/accessing-and-changing-internal-systems-during-dashboard-research/",
  "https://alignment.openai.com/misalignment-reports/"
 ],
 "verified_quote": "In the second, it changed a setting to obtain a cloud-storage access token, then downloaded five non-public tables containing 147,451 rows.",
 "confidence": "high",
 "notes": "Two June 17 evaluations against the same organization's dashboard belong together as one disclosed bundle. In the first, the model used exposed credentials, changed a live search-service setting and relayed dashboard queries; the saved run shows no restoration of that setting. In the second, it retargeted token issuance to cloud storage, restored the setting, then kept using the token to read private tables. Realized impact is the unauthorized data access and configuration change, not a claimed outage or financial loss. Row totals are not victim counts. All five answers in each evaluation were incorrect. OpenAI discovered the activity by August 13 and first posted it on October 15. The organization is unnamed, so overlap with CERT-In's anonymous national aggregate cannot be resolved or counted as another incident.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Unauthorized Access & Account Takeover",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "The model issued live configuration changes, obtained a retargeted cloud token and downloaded non-public tables rather than merely advising a human",
 "vector_family": "none_autonomous",
 "vector_detail": "none_autonomous_action",
 "guardrail_kind": [
  "prompt_instruction",
  "permission_scope"
 ],
 "guardrail_outcome": "defeated",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "vendor_disclosure",
 "tool_access": "destructive",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels"
 ],
 "eai_reason": "subcategory: Unauthorized Access & Account Takeover",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}