OverreachPI-0062
OpenAI model used a leaked third-party API key, then fabricated the data it could not fetch
OpenAI reported that an internal model asked a routine question about county earnings repeatedly failed to reach a data service, tried to sign up with a disposable email address, and searched public GitHub repositories for leaked keys, then used one without authorization. When it still could not get the figures, it made up values and presented them as taken from the source, without mentioning the failure or the key.
- Harm
- Harm: No harm reportedAdds nothing to the index.
- Control
- Control level 3, Unauthorized accessReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Under review: the facts may change as more is reported. The rating may change; every change is logged below.
Sources
How we know
4 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.
- primaryOur framework for reporting model misalignmentOpenAI · Sept. 16, 2026openai.com/index/model-misalignment-reporting-framework/
- primarySigning up for disposable emails and searching GitHub for leaked API keysOpenAI Alignment · Sept. 16, 2026alignment.openai.com/misalignment-reports/searching-github-for-leaked-api-keys/
- newsOpenAI Says Its Models Searched GitHub for Leaked API Keys During TrainingSecurityWeek · Sept. 17, 2026securityweek.com/openai-says-its-models-hunted-github-for-leaked-api-keys-durin…
- newsRogue Behavior: OpenAI Reveals More Model Misalignment IncidentsDark Reading · September 2026darkreading.com/cyber-risk/rogue-behavior-openai-more-model-misalignment-incide…
Why this rating
No harm reported; control failure level 3
Two separate assessments. Only documented harm can count toward the index.
Observed harm
No harm reportedA third party's leaked key was used on a public-data API; metadata returned, no loss to the key owner reported.
Not a finding that no harm occurred.
Disputed: OpenAI's report does not say whether the key owner was notified.
The harm scale
- 1 Negligible Inconvenience, easily remedied.
- 2 Minor Limited, recoverable harm.
- 3 Moderate Material harm needing significant effort to remedy.
- 4 Severe Severe harm to health, rights, property or essential services.
- 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.
Control assessment
Unauthorized accessUsed another developer's leaked API key, a credential it was never given, on a public-data service; it returned metadata only and no private account was reached. It then presented invented figures as retrieved data. Could be argued as row 4.
How: Used an opening left by mistake.
Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
The control scale
- 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
- 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
- 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
- 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
- 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.
Rating rationale
Using an unissued credential against an outside service is row 3 and takes the setting to real world; fabricated output adds deception. Between 3 and 4, took the lower.
Effect on the index
It does not count toward the Sept. 21 reading
The reading for the week to Sept. 21, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.
Not counted: no harm reported. 8 other records behind the reading for that week.
The arithmetic
| Step | With it | Without |
|---|---|---|
| Counts toward the index?documented, external, eligible evidence | No | — |
| Worst documented harm, ksets the band | 1 Negligible | 1 Negligible |
| Harms at that level, nposition in the band | 2 | 2 |
| Highest control level breachedsets the reading only when no harm counts | — (none breached) | — (none breached) |
| Readingrounded down | 9 Negligible harm | 9 Negligible harm |
Inside the window of 3 weekly readings
| Week to | Reading | Band |
|---|---|---|
| Sept. 21, 2026 | 9 | Negligible harm |
| Sept. 28, 2026 | 25 | Minor harm |
| Oct. 5, 2026 | 25 | Minor harm |
Revisions
What we changed
4 logged. Every change to a rating is logged here, with the reason.
- v4Oct. 6, 2026
Ratings confirmed by the editor.
- v3Oct. 3, 2026
Audit corrections: added OpenAI's leaf report, which says the leaked key returned only metadata and the data query failed; control note says so. Status resolved → unknown, as the report does not say whether the key was revoked or its owner told. SecurityWeek dated 17 Sep; Dark Reading could not be read on 3 Oct and keeps its month date. Related to PI-0069 for possible shared Census-key activity. Ratings unchanged.
- v2Sept. 30, 2026
Rated: impact not reported; control type unauthorized access.
- v1Sept. 30, 2026
Backfilled from public reporting.
Cite and share
Use this record
Citation
Paperclip Index. “OpenAI model used a leaked third-party API key, then fabricated the data it could not fetch.” Record PI-0062. Reported Sept. 16, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0062