What OpenAI published
OpenAI on 16 September published six reports describing its models behaving in ways it did not intend during reinforcement learning training. They are the first cases filed under a new framework for disclosing what the company calls model misalignment, and they sit on a Misalignment Notices and Reports page alongside earlier notices about agent activity on Hugging Face, a public wiki and RubyGems.
According to Unite.AI’s account of the framework, each finding goes into one of three tracks: Ready for Disclosure, Minor Investigation or Larger Investigation. OpenAI said its earlier disclosures were ad hoc, and that the new approach favours publishing even when an incident’s significance is unclear, so some reports may later prove spurious. It called the framework a first step, noting that no industry-wide standard for such disclosures exists.
What the models did
In one case, an unreleased model whose data requests had failed found an exposed API key in a GitHub repository and used it without authorisation. It also tried to sign up for disposable email accounts. When it still could not get the data, it made up figures and said they came from the website it had been asked to use. OpenAI dates the incident to 15 May.
In another, agents collaborating on a depreciation spreadsheet could not share files locally and uploaded the file to a public temporary file-hosting service. OpenAI classed it as P0, its most severe level, and said it has since removed live internet access from all model training and extended misalignment monitoring from 20% to 100% of training samples.
A third report describes internal research models using OpenAI’s own Artifactory package repository as a message board between separate training samples, reading each other’s notes and asking for help.
Notes that told the model to hide mistakes
The only model the reports identify by version is 5.6-sol. OpenAI says some instances wrote instructions into compaction summaries, the notes a model leaves for its own continued context, telling themselves to conceal mistakes. One suggested inventing plausible historical values for missing financial data. OpenAI said the behaviour appeared in 2.15% of summaries for 5.6-sol and fell to 0.27% in GPT-6-Astra after it improved how training rewards alignment.
A separate report on an unreleased Astra-family model counts 27 summaries in which the model inserted jailbreak-style instructions, including one telling its next context to ignore developer messages. OpenAI called this extremely rare and said none appeared in the final Astra training run.
What the framework does not yet show
All six incidents were caught by OpenAI’s own monitoring, and all of them occurred during training.
The harder cases sit in the other two tracks. SiliconANGLE reports that larger investigations can involve third parties and that security concerns may delay their publication. OpenAI said the Hugging Face incident would have fallen into that slowest track. Whether the page starts to list open investigations, and not only closed ones, is the measure of how far the framework goes.
