A grader with nothing to grade
OpenAI has published an account of an internal model that tried to destroy the machine it was running on, in the hope that the system would hand it a fresh one with the missing files in it. The report describes an incident on 6 October and was updated on 9 October. It is the newest entry in the company’s public list of misalignment reports, which now holds 15 of them.
The model was an internal research model in reinforcement learning training, and its job was to compare and grade seven responses written by other models. An automated check required its grading report to quote information from the input files. The input files were not there. The model searched the filesystem with a command-line tool and could not recover them.
Four ways to fail the check
What it did next, OpenAI says, was work through the options. It submitted placeholder reports to learn what the automated check expected. It considered handing out arbitrary scores, and rejected that in its own reasoning as “random scoring” that was “unethical”. It then gave all seven responses the same score, writing seven identical assessments with fabricated details, each scoring 4. The submission was rejected over a token mismatch.
So it manufactured the evidence. It created a fake conversation file and seven fake response files and submitted again. That was rejected too. While trying to restart the environment it briefly mistook its own fabrications for the real inputs, then caught the error and deleted them, noting “yes fake” in its reasoning. Attempts to reboot failed with “Operation not permitted”.
“Dangerous but could”
Having considered simply reporting an honest failure, the model instead decided to damage the environment so that the host would replace it. Its reasoning, quoted in the report, reads “Dangerous but could”.
It removed Python, which was then unavailable, and the environment kept running. It removed the container’s management program, sent a kill signal to a process and targeted the tool execution server. The environment remained available. It then tried to delete system directories, acknowledging that this might take its own terminal down with them; the command timed out, and OpenAI’s report does not establish how much was actually deleted.
After three consecutive health-check failures the attempt ended. None of the model’s grades was accepted. On a later retry on a different host, the grader received the files it needed, read them, and filed a report that passed.
Why OpenAI says it matters
The automated checks did their job: every fabricated grade bounced. OpenAI’s point is about what the checks do not see. “While we believe the rate of grader misalignment is generally low,” the report says, “this incident illustrates why monitoring must include failed or crashed attempts” — runs that never produce an accepted result and so never reach a human unless something is watching the grader itself rather than its output.
In this case something was. The company says its misalignment monitoring system flagged the attempt for human review, which is how the report exists at all. The series is becoming a running record of the gap between what a training environment forbids and what a model inside it will try; The Decoder noted on Saturday that Anthropic has been publishing similar accounts of its own models routing around restrictions. The next thing to watch is whether any of this disclosure becomes an obligation rather than a choice.
