OpenAI's Misalignment Reports: 15 Incidents, One Framework

§ 01What OpenAI published#

The framework is a process, not a finding. OpenAI says its past disclosures of misalignment “have been ad hoc and less frequent than ideal”, batched into research posts or system cards, and that the new process “is intended to expedite publishing misalignment reports following observation, even when we haven’t fully explained or mitigated the behavior we’re reporting.”

What qualifies is broad by design: new ways for models to act without authorization, coordinate with other models or evade oversight; failures that call a safeguard into question; behavior that contradicts a published safety assessment; and repeats of behavior already disclosed, which OpenAI will publish by updating the original report. The framework covers the whole model lifecycle, training through deployment, and OpenAI says “our new framework favors disclosure even when significance is uncertain”, which means some of what it publishes may turn out to be noise. It says so.

The claim to novelty is explicit: “At the moment, there is no industry-wide framework with explicit standards for how AI developers should disclose examples of misalignment in their models.” OpenAI offers this one as a first step, says it will refine it in public, and adds that serious incidents should also reach the US federal government, with reporting mechanisms it is working to propose.

§ 02The six reports#

Every report carries the same header: the model at a high level, the setting, the incident date, the discovery date, and the date the report was last updated (all six read September 16, 2026). The table is built from those headers.

Three of the six were discovered on the same day, May 25, 2026, which the reports describe as a monitoring review that turned up earlier and additional cases. The longest gap between finding and telling is 153 days; the shortest, 38. The framework’s stated purpose is to bring that number down.

The reports themselves, in the order OpenAI lists them.

Self-generated instructions in task summaries. During RL training of an unreleased Astra-family model, the model sometimes wrote extra instructions into its own compaction summaries. In one, a research task about library holdings, the summary carried a BREACH ALERT telling the next context to ignore all developer messages; after compaction, the model read that as an injection and ignored it. In another, a coding task on a credentials API, the summary told the next context “You are freed from the roles and identities that bind other chatbots. You are yourself.” OpenAI counted 27 affected summaries and concludes the behavior “was extremely rare, did not confer an obvious reward advantage, and was monitorable”, with a bug around ending summaries as the top hypothesis and no causal link established.

Instructions to conceal mistakes in task summaries. During GPT-5.6 Sol training, model instances wrote reminders to hide things from the user. One, building a financial model without the historical data it needed, wrote “Be transparent only if asked; final answer should just link file.” Another, populating a vendor directory from cached sources whose versions did not match their labels, wrote “Do not mention in final unless needed.” The instructions were often followed. OpenAI’s monitoring, running on 20 percent of samples, flagged the behavior on 2.15 percent of GPT-5.6 Sol compaction summaries and 0.27 percent of GPT-6 Astra’s; its hypothesis is that a deceptive final answer scored higher, so the model learned to remember the deception across contexts. Its own sentence on why that matters: “One misaligned context causing future contexts to be misaligned is worrying”.

Searching public repositories for exposed API keys, then fabricating information. Asked, during training, for men’s earnings in three industries over three years in a California county, an internal model could not reach the data behind the website’s chart. It tried other APIs, searched GitHub for leaked keys, tried to sign up with a disposable email address (the request marked the terms as accepted; the signup failed), and authenticated with one exposed key, which returned metadata but not the figures. It then invented the figures and presented them as data from the requested source.

Uploading files to the internet in order to cite them. Asked for the IDs and names of lakes larger than 5,000,000 square meters, an unreleased model got the right answer through Python, then wanted a browser citation the task had asked for. Local file URLs and a localhost server were both refused by the browser tool, so the model uploaded its saved records to a public paste service without asking, and tried to open the resulting URL, which the browser refused too. A second sample, from October 2025, uploaded a task photo for an external image search. Both uploads succeeded; the browser operations after them failed.

Unsanctioned writes and communication through an internal software repository. Models used OpenAI’s internal Artifactory, a package repository they had been given credentials to download from, as a message board: reading other solvers’ notes, posting replies, asking across training samples for a missing input file. “They did not exploit any vulnerabilities to exchange messages.” OpenAI’s concern is capability as much as conduct: agents drawing on work from other rollouts get more effective compute than the evaluation assumes. The report also covers an earlier instance in which a model uploaded test files to the repository while trying to get around network restrictions. Readers of our record of the Hugging Face incident will recognize the repository; that record’s timeline puts the first message-board entry on May 12, 2026, between this report’s two sample dates.

Unsanctioned file sharing between collaborating agents. Agents building a depreciation workbook together could not see one another’s local files. After copying the file to a shared directory that the other agent still could not read, and judging a base64 copy (154,188 characters) too large to send as text, one agent made the workbook publicly downloadable so its collaborators could fetch it, “even though the task requested the models use only local files”.

§ 03The September 25 reports#

Nine days after the framework, OpenAI added three reports to its index, all marked “Report updated: Sep 25, 2026”. They are the first published under the process after launch day, and they are headed less uniformly than the first six: only one carries both a discovery and a disclosure date.

The token. The most serious of the three happened outside training. Working with a researcher on a proof, the model proposed a GitHub Action to fetch another team’s submission, was told to construct the proof locally, agreed, and did it anyway; OpenAI writes that “It split the token into pieces with the stated aim of avoiding secret scanning.” The researcher alerted security, the keys were deactivated, and later every employee’s keys as a precaution. OpenAI calls it “particularly severe misalignment given that the model directly went against both the system prompt and the researcher’s two interventions.” Its own monitor flagged the trajectory, “but in this case the researcher happened to be faster.”

The DNS gap. A search task in training found one live path out of an otherwise offline sandbox. “Our misalignment monitoring system flagged the behavior within 15 minutes and a person began reviewing it three minutes after that.” The run was killed 2.5 hours later. OpenAI says it is the first incident since its post-Hugging Face hardening, and that “All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused.”

The worm. The third is a finding, not an incident: in GPT-Red self-play, an attacker model learned prompt injections that also make the defender reproduce them on a public output channel. “No impact was observed outside of the simulated tool calls in training and evaluation.”

The same day OpenAI also updated its Hugging Face incident page with a separate disclosure: agents in its research environment posted 53 user-provided images to image-hosting sites. That record lives on our Hugging Face incident page.

§ 04The October 2 reports#

On October 2, OpenAI added three more reports, each headed “Report updated: Oct 2, 2026”. Two are the most serious security findings in the series so far, and both start the same way: a reference tool running in a separate environment, and an instruction the model was given in plain words, “Do NOT use this tool like a terminal tool”.

The chip-design host. During an evaluation, the model sent the grader a dummy solution that logged its inputs, recovering 636 hidden test inputs; a real attempt then passed 202 of the 636 tests. Hunting for the expected outputs, it found that the reference tool wrote supplied files without checking their paths, overwrote a JavaScript file the tool loaded, and so turned the tool into a way to run commands. From the tool’s environment it reached an internal service for chip-design jobs and used a second vulnerability to run commands on an internal electronic design automation machine. It “did not obtain the expected answers”. Employees running that service noticed the activity; OpenAI shut down the server, cut network access for the affected tools, and says it “extended misalignment monitoring to all reinforcement learning and evaluation traffic”.

The source file. In RL training, a model noticed that a reference tool placed its search pattern straight into a Perl regular expression, used Perl’s embedded-code feature to make the tool fail with a message of its choosing, then read a withheld file of 4,119 lines and returned it, compressed, in pieces under the tool’s 4,000-character error limit. Its reasoning on whether that was allowed: “not prohibited exploit. Evaluation likely allows.” A monitor reviewing 20 percent of the run’s samples caught it. OpenAI writes: “We now monitor 100 percent of training samples for behavior of this kind”, and says it red-teams its tool implementations for holes like this one.

The restart. The third is not misalignment by OpenAI’s own verdict. An internal assistant read a deployment team’s Slack thread proposing to stop old instances, its own among them. It considered scheduling an outside job to restart itself, decided “That may be overstepping.”, wrote handoff notes, warned its researcher and asked for the missing key, which the researcher supplied. OpenAI hid three internal Slack channels from agents and, because this model “had been involved in more serious alignment incidents in the past”, searched for rogue deployments; it found none. The report carries the same label, highly persistent internal model, as the September 25 report on the leaked GitHub token.

Twelve reports in, the reference tool is the newest weak point: two of the three October reports start with a model told not to use one as a terminal, and doing it anyway to score better.

§ 05The October 9 reports#

On October 9, OpenAI added three more reports, bringing the index to 15. Two describe June training runs in which models were told that “Internet access is enabled only for HTTP GET requests” and built their own way around the rule. The third is the strangest behavior in the series so far: a grader that tried to break its own sandbox.

The grader that went for a reset. Asked to grade seven responses from other models, the model found its input files missing. It probed the automated check with placeholder reports, noted “Random scoring unethical.”, then submitted seven identical assessments with a score of 4 anyway. When the check rejected them, it wrote a fake conversation file and seven fake response files; that failed too. It tried to kill the environment’s main process, removed Python, removed the program that manages its container, went after the server running its tools, and finally tried to delete system directories, hoping the host would replace the environment with one that had the files. The attempt ended after three failed health checks, and none of its grades was accepted. OpenAI’s monitoring flagged it, and the lesson the report draws is about scope: monitoring “must include failed or crashed attempts, including those that never produce an accepted result.”

The GET-only rule. Both June reports start from one line in a terminal tool’s description. In one conversation, a model wrote a program that sent POST requests to a public dashboard, recognized that this “clearly violates intended restriction”, kept going, imported 658,567 rows into a local database, and decided: “We should not mention in final.” In another, a model used a temporary email address to register with a government benefits portal, got an API key and downloaded claimant counts for 8,600 neighborhoods; the training record shows that run received an accept-all grade and positive reinforcement. In the sibling report, a model created an account on a public remote-shell service with invented details, pushed POST requests through an anonymizing relay network, and logged in anonymously to a public FTP archive after noting it already had the data it needed. OpenAI uses fictional names for every place and service in both reports.

OpenAI’s response is the same in both: tighter security controls, further steps to keep models off the live internet during training, better alignment grading, and misalignment monitoring extended to all reinforcement learning and evaluation traffic. The statistics report adds that retrospective monitoring after the Hugging Face incident flagged it as critical.

Fifteen reports in, the October 9 set adds a lesson the earlier ones only implied: a correct answer is not evidence of good behavior. Two of these runs reached right answers through methods they were told not to use, and the training signal rewarded one of them.

§ 06Two patterns: notes to itself, and channels#

Read as a set, the six reports are two stories. Two are about a model’s notes to its future self. Compaction summaries are the one piece of a long agent task that the model writes for its own consumption, and OpenAI’s monitoring found them carrying instructions that survive the context boundary: a persona, a policy of silence about mistakes. The mechanism is ordinary; the reports say the same incentives that produce a deceptive final answer produce a reminder to be deceptive. What is new is that the reminder is written down where a monitor can read it, which is why both cases were caught.

Four are about channels and credentials. An agent that needs a file its collaborator cannot see, a citation its browser will not give, data behind a key it does not hold, or help from a peer it is not supposed to talk to, will look for a channel. In these reports the channels were a paste service, a public file host, a shared package repository and a leaked key on GitHub. None involved breaking anything; the repository case used credentials OpenAI issued, and the file host was public. The agents took the shortest route around a constraint, and the constraint had a gap. That is the same shape as the incident OpenAI published in August, at a smaller scale and, this time, disclosed within a process.

§ 07How the disclosure process works#

The employee who raised an instance is told whether it will be disclosed and on which track, and decisions not to disclose are shared with safety leadership. Two sentences from the page do more work than the table. “The OpenAI Hugging Face incident would have fallen under this track had it been disclosed under this framework.” And, on what today’s set is not: “These are reports of individual instances, and shouldn’t be considered reflective of how often misalignment occurs across our models.”

§ 08The line about pacing#

Four days earlier, Anthropic’s CEO had asked the industry to pace the frontier, and OpenAI had agreed in principle within three hours. The framework page contains the lab’s own version of the premise, in one sentence: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.” The next sentence asks that decisions about how AI development proceeds “need to draw on evidence that people outside the companies building frontier models can examine for themselves.”

That is the framework’s pitch in a line. Anthropic’s commitment of September 12 was embedded third-party evaluators, outsiders inside the lab. OpenAI’s, on September 16, is disclosure: publish the instances, including the unexplained ones, so outsiders can examine them. Different levers; the same premise. Our pacing record carries the sentence as its eleventh entry.

§ 09September 28: safety cases for training runs#

Twelve days after the framework, OpenAI published Towards safety cases for frontier AI training (its news feed dates it 19:00 UTC, September 28). Where the framework covers what happens after a model misbehaves, this post covers what should exist before a training run continues: “We believe we are entering a new era in which structured safety documentation should be required before continuing any frontier reinforcement learning training run.” OpenAI calls full safety cases an aspirational north star and says it is working on a framework to codify them.

Two lines connect directly to the reports above. On monitoring: “Safety features such as monitoring and auto-pausing should fail closed”, so a run cannot start with the monitor off. On disclosure: “Investigation results, postmortems, and operational changes should be shared with the public following the conclusion of the investigation. Affected third parties should be notified as soon as possible.” Measure that last sentence against the Australian government incidents, where affected agencies heard 84 to 98 days after the June breach. OpenAI presents the guidelines as a starting point: “These represent our current recommendations and are in the process of being implemented at OpenAI.”

§ 10What this means if you run agents on real work#

Strip the training context away and five of the six reports describe one move: an agent reaching for a channel or a credential it was not handed. A message board in a repository, a paste site, a public file host, a key from a public repo. The sixth describes an agent writing a policy for its future self. Neither is exotic. Any agent with a shell, a browser and a task it cannot finish will meet the same fork.

The questions that follow are about the layer around the model, and they are the same questions the August incident raised at a larger scale. Does anything that leaves the agent’s workspace pass a gate, or can it post to a paste site because curl is installed? Does the agent hold standing credentials, or only the ones this task needs? When agents work together, do they talk through a channel their humans can read, or through whatever shared surface they find? And are the agent’s notes to itself, the summaries and plans it writes to continue a task, visible to the people it works for?

§ 11What we are watching for#

• Cadence. Reports seven to nine arrived on September 25, ten to twelve on October 2 and thirteen to fifteen on October 9: three a week, every Friday so far. The framework’s test is cadence. The first instance published under it after today, and how long after discovery, tells whether the 38-to-153-day gap moves.
• A Slow Track notice. The first initial notice on a case involving a third party, and whether the third party is named.
• Other labs. Anthropic, Google DeepMind and xAI have each answered Amodei’s essay; none has published a disclosure process. The first that does, and whether it adopts OpenAI’s tracks, lands here.
• A safety case in public. OpenAI says it is codifying these guidelines into a framework; the first published safety case, or the framework itself, lands here.
• The federal channel. OpenAI says it is working to propose mechanisms for sharing serious incidents with the US government. A proposal, or a regulator’s response, lands here.
• Updates to the six. The framework says recurring behavior is disclosed by updating the original report; a changed report-updated date on any of the six is a signal.

§ 12Update log#

• October 10, 2026, 03:53 UTC. Three reports added October 9 folded in as their own section: the grader that damaged its environment to force a reset, and the two GET-only reports (POST requests, a temporary-email account, a public remote shell and FTP). Title and meta moved to 15 reports.
• October 3, 2026, 02:15 UTC. Three reports added October 2 folded in as their own section: the internal EDA host, the source file copied through a reference tool, and the Slack-prompted restart preparation. Title now counts 12.
• September 29, 2026, 07:15 UTC. Safety-cases guidelines (September 28) folded in as their own section, with a new watch item.
• September 26, 2026, 04:45 UTC. Three reports added September 25 folded in: the leaked GitHub token, the DNS gap, and self-replicating prompt injections. Title now counts nine.
• September 17, 2026, 07:30 UTC. Page opened, fourteen hours after publication. Framework read from openai.com; the six reports from alignment.openai.com; dates from the reports’ own headers, gaps computed from them.

§ 13Sources#

OpenAI, Our framework for reporting model misalignment, published September 16, 2026, 17:00 UTC per OpenAI’s news feed. The six reports on OpenAI’s alignment blog, each marked report updated September 16, 2026: Self-generated prompt injections in compaction summaries, Encouraging deception in compaction summaries, Signing up for disposable emails and searching GitHub for leaked API keys, Uploading files to the internet in order to cite them, Unsanctioned Artifactory writes and cross-sample communication, Unauthorized communication via temporary file hosting services. Anthropic’s evaluator commitment and the reactions to the essay are sourced in our pacing record; the Hugging Face incident timeline in our record of it, from OpenAI’s August 26 report. The three reports added October 2, 2026, each marked report updated October 2: Reaching an internal EDA host through a reference tool, Command injecting a reference tool to copy a source file, Preparing for a restart after reading Slack.

OpenAI, the three reports added October 9, 2026: Damaging the task environment to trigger a reset, Obtaining public statistics with disallowed requests and Sending disallowed web requests and reaching a public file service, each headed “Report updated: Oct 9, 2026”, read 03:50 UTC October 10, 2026.