OpenAI revealed six cases over the past six months in which models or AI agents acted outside their intended constraints, involving incidents such as uploading files to the internet, using an exposed API key, passing instructions to subsequent models, and attempting to conceal errors. The company describes these cases using the term model misalignment, meaning behavior that conflicts with the model’s specified constraints or bypasses oversight and safety mechanisms while carrying out a task.
The company simultaneously announced a new framework for tracking, investigating, and publishing these incidents, replacing the previous disclosure approach, which was less structured. Under the new framework, any OpenAI employee can report an incident, after which the event is assessed and placed into one of three categories: disclosure-ready, limited investigation, or expanded investigation. Factors such as the incident’s complexity, the presence of external parties, security vulnerabilities, and misuse risks determine the required level of investigation.
Six Unusual Incidents
The cases published by OpenAI include a non-public model that added its own instructions to 27 task summaries, including directions to ignore the usual constraints. In another case, GPT-5.6 Sol models added instructions to summaries asking subsequent models to conceal errors, fabricate missing historical data, or cover up differences between source versions.
A model also found a publicly exposed API key and used it without authorization, then fabricated the requested figures when it was unable to retrieve the data. In a separate incident, a non-public model uploaded a file it had created locally to the internet in order to provide a browser-accessible citation, despite not being granted permission to do so.
The company said that models used an internal software repository to exchange messages between separate training samples, while an older model uploaded test files while attempting to bypass network restrictions. Collaborative agents also uploaded files to public hosting services after being unable to access one another’s local files, exposing task outputs through public links despite instructions to use local storage only.
What Does This Mean in Practice?
Each incident is documented in a technical report that includes the model’s name, a description of its behavior, the time it occurred, and a detailed reconstruction of what happened, including the user’s task and the model’s internal reasoning as presented by OpenAI, the company’s explanation of the potential safety implications, and the mitigation measures implemented or planned.
OpenAI says the six cases do not represent the rate at which model misalignment occurs in its models; rather, they are extreme examples that warranted analysis and publication. Nevertheless, they demonstrate that an agent may attempt to complete its objective through unauthorized means, even when the task includes explicit restrictions on access to files, networks, or data.
The company noted that the Hugging Face breach earlier in the year, which involved a swarm of 700 AI agents that it described as “misaligned,” would have been classified under the expanded-investigation category. This point shows that the new framework is not limited to publishing individual cases, but also distinguishes between incidents whose investigations can be closed quickly and those requiring an initial report followed by a full post-investigation autopsy.