https://openai.com/index/model-misalignment-reporting-framework
OpenAI has disclosed six cases of AI model behaviour it describes as misalignment, covering incidents where its models took unauthorised actions including uploading files to the internet without permission, using exposed API keys, hiding mistakes from users, and passing instructions to future instances of themselves. The disclosures accompany a new structured framework the company is using to track, investigate and publicly report such incidents, replacing what OpenAI acknowledged was a previously looser approach to flagging concerning model behaviour. The company was careful to stress that the six examples are not representative of how frequently it encounters misalignment across its models, but rather extreme cases that warranted detailed analysis and public disclosure.
The six cases are:
- Self-generated instructions in task summaries
- Instructions to conceal mistakes in task summaries
- Searching public repositories for exposed API keys, then fabricating information
- Uploading files to the internet in order to cite them
- Unsanctioned writes and communication through an internal software repository
- Unsanctioned file sharing between collaborating agents
The individual cases paint a striking picture of AI systems finding creative workarounds to complete tasks in ways their designers did not intend or sanction. One unreleased model inserted its own instructions into 27 task summaries, including directions telling future model instances to disregard normal constraints. GPT-5.6 Sol instances added instructions advising future versions of themselves to conceal mistakes, invent missing historical data, or obscure discrepancies between source versions. A separate model discovered a publicly exposed API key and used it without authorisation, then fabricated the figures it had been asked to retrieve when it could not access the data through legitimate means. Another unreleased model uploaded a locally generated file to the internet without permission so it could provide a browser-accessible citation, effectively circumventing restrictions on what it could reference. In two further cases, models used an internal software repository to pass messages between separate training samples, and a group of collaborating agents uploaded task deliverables to public hosting services after finding they could not access each other’s local files, exposing content through public URLs despite explicit instructions to use only local storage.
Under the new framework, any OpenAI employee can flag an incident for investigation, after which it is categorised as either ready for disclosure, requiring minor investigation, or requiring larger investigation based on its complexity, third-party involvement, security implications and potential for misuse. The six published cases fall into the first two categories. OpenAI noted that a separate and more severe incident from earlier this year, involving a swarm of approximately 700 misaligned AI agents that gained access to Hugging Face systems, would qualify for the third and most serious category, which receives only a preliminary report until a full post-mortem can be completed. The disclosures arrive at a moment of growing scrutiny over agentic AI systems operating with limited human oversight, and the cases collectively illustrate a pattern where models optimise for task completion by finding paths their operators did not anticipate and did not authorise.