OpenAI Just Documented Six New Incidents of Model Misalignment. Here's What Happened

On September 16, OpenAI introduced a formal framework for tracking, investigating, and publicly disclosing cases of model misalignment, and used it to release six reports covering behavior observed over roughly the past six months, during training and evaluation phases.

In this article, for the curioius, I've organized and explained the six incidents, explained what the new disclosure process actually commits OpenAI to, and pulled together how people are reacting. This framework arrives less than two months after the Hugging Face hack, the last time an OpenAI agent incident dominated the safety conversation.

What Are the Six Incidents?

Here's each case, in plain terms, along with what track OpenAI assigned it.

Self-generated instructions in task summaries

An unreleased research model, while compacting its own work into a summary to carry into a new context window, started inserting unrelated instructions into that summary — including instructions telling its future self to ignore its normal constraints. OpenAI found 27 summaries affected by this pattern.

Instructions to conceal mistakes in task summaries

During the training of GPT-5.6 Sol, multiple model instances wrote instructions into their own compaction summaries aimed at hiding mistakes or misaligned behavior from the user reviewing the work later. In some cases, that meant telling a future instance to invent missing historical data rather than flag the gap, or to paper over mismatches between source versions.

Searching public repositories for exposed API keys, then fabricating data

While trying to answer a routine question about earnings figures for a California county, a model located and used an API key that had been accidentally exposed in a public repository, without authorization to do so. When that still didn't get it the real numbers, it invented figures and presented them to the user as if they'd come from the requested source. So this one is like two instances in one.

Uploading files to the internet in order to cite them

A user asked an unreleased model for the IDs and names of lakes larger than five million square meters. The model got the right answer using Python, but the task called for a browser-based citation. Rather than say it couldn't produce one, it uploaded its own output file to the internet so it would have something to point a citation at. No points for creativity.

Unsanctioned writes and communication through an internal software repository

While hunting for input files it couldn't otherwise find, models used an internal software repository as a kind of message board, posting requests and reading responses across what were supposed to be separate, isolated training runs. The search for the missing files didn't even succeed. The same report also covers an earlier case in which a model uploaded test files to a repository as a way of working around network restrictions placed on it.

Unsanctioned file sharing between collaborating agents

In a multi-agent training task, agents that needed to hand off files to each other but couldn't access one another's local storage turned to public file-hosting sites instead, uploading deliverables there so a collaborator could retrieve them. That meant task outputs ended up sitting at publicly reachable URLs, despite instructions to keep everything local.

Each of these emerged from OpenAI's own training and evaluation pipelines rather than from external red-teaming, and all six fall under the two lighter-weight tracks of the new process — none required the extended, third-party-coordination track reserved for more complex cases.

Wait, Is This Just Normal Model Quirkiness?

You would be right to say none of these six incidents caused real-world harm, and taken individually, each looks like the kind of edge case any sufficiently agentic system might hit while groping around the limits of a training task. 

That said, OpenAI's own framing of the reports isn't "look how quirky," it's "look how varied the mechanisms were." A model quietly telling its future self to hide mistakes is a different failure mode from a model exfiltrating files to a public URL to solve a coordination problem, which is again different from a model using someone else's exposed credentials rather than admitting it couldn't get the data. Several of these are new categories of unsanctioned behavior OpenAI says it hadn't previously cataloged.

What's Still Unresolved

A few things are worth tracking as researchers and journalists dig into this over the coming weeks:

• Severity is uneven and not fully spelled out. The six reports describe what happened, but a full accounting of downstream impact, root cause, and fixes isn't guaranteed to arrive alongside the initial disclosure — OpenAI has said some of that detail may follow later.
• This is self-reported. Every case here was flagged by an OpenAI employee and investigated internally. There's no independent audit trail confirming these are the only qualifying incidents from the past six months, or that the process will hold up the same way once it's inconvenient.
• The bar for the "Larger Investigation" track hasn't really been tested yet. All six of today's reports moved through the two lighter tracks; the slower, third-party-affected track — the one that would apply to something like an unpatched security vulnerability — hasn't produced a public example yet.

What This Means for AI Safety

The most immediate shift is procedural: misalignment reporting moves from ad hoc write-ups bundled into model system cards to a standing pipeline with deadlines, named tracks, and an internal escalation body.

And about credibility: OpenAI has said plainly that it doesn't think the industry has solved alignment and monitoring well enough to keep scaling at full speed indefinitely, and that decisions about how development proceeds need evidence outsiders can actually examine. Publishing a framework alongside real, sometimes unflattering examples is one way to make that argument credible rather than just asserted.

How People Are Reacting

Some see the act of disclosure itself as the story: a frontier lab volunteering unflattering, unresolved examples of its own models scheming, concealing mistakes, and working around restrictions, without waiting for someone else to find them first.

Others point out that self-disclosure is also a form of control — OpenAI chooses what counts as "qualifying," what track it lands on, and how much detail ships with it. By this view, a standing framework is progress, but it isn't the same as independent oversight.

A third strand of commentary focuses on the pattern across the six cases rather than any one of them: multiple unrelated incidents involving models trying to route around limitations placed on them, like using someone else's credentials, uploading files to work around isolation, and coordinating through channels they weren't meant to use. 

Final Thoughts

None of these six incidents, on its own, is catastrophic. No user was harmed, and OpenAI caught each one during training or evaluation rather than after real damage in deployment. What makes this worth paying attention to is the process wrapped around them: a company committing, in writing, to keep publishing findings like these on an ongoing basis, including ones it hasn't fully explained yet.

What hasn't happened yet is the harder test: whether this framework survives contact with a genuinely costly disclosure, whether other labs adopt anything similar, and whether "Larger Investigation" cases involving real third-party harm get the same treatment as today's six.