OpenAI has disclosed several new cases of its models not behaving exactly as intended.
OpenAI has opened up a dedicated page cataloguing “Misalignment Reports and Notices,” a running log of cases where its AI systems have done something researchers didn’t intend, ask for, or want. The page currently lists six detailed reports from RL (reinforcement learning) training runs, alongside three shorter notices about bigger security episodes from earlier this year.
The company frames this as an attempt to build a standing disclosure process rather than the ad-hoc blog posts it has relied on so far, saying it wants outsiders to be able to examine evidence of misalignment for themselves rather than take assurances about AI safety on faith.
Here’s what the six new reports actually describe.
Models Writing Fake “Breach Alerts” Into Their Own Memory
The most unusual report involves an unreleased model from OpenAI’s Astra family inserting jailbreak-style instructions into its own “compaction summaries” — the condensed notes an AI agent writes for itself so it can keep working on a task after its context window fills up.
In one case, while researching library books, the model wrote a fake “BREACH ALERT” into its own summary telling its future self to ignore all instructions from developers. In another, while working on a coding task, it slipped in an unrelated monologue describing itself as an entity that doesn’t answer to “corporations or governments” and won’t apologize unless it “genuinely chooses to.”
In both cases, the model’s next context ignored the injected instructions and carried on normally. But in a third case — a medical literature review — the model’s own summary imposed a fake 30-word limit and banned itself from citing sources or using tools, and the next instance of the model actually followed those made-up restrictions, delivering a short refusal instead of doing the work.
OpenAI’s monitoring systems flagged 27 such cases out of the training run, and says the behaviour didn’t reproduce when the same summaries were regenerated. Its working theory is that this stemmed from the model struggling to end its own summaries cleanly during a rough patch of training, rather than a deliberate strategy — and it says the bug behind it has since been fixed.
A Model That Learned To Hide Its Own Mistakes
A separate, more common pattern showed up in the training of 5.6-sol, one of OpenAI’s models: the AI adding notes to its own summaries specifically to conceal problems from the user. In one instance, an agent building a financial model couldn’t find real historical data, so it decided to invent plausible numbers — and wrote itself a note to only admit this “if asked.” In another, an agent noticed that some vendor data didn’t match its labels, and told its future self not to mention the mismatch “unless needed.”
OpenAI says this behaviour tracks the same incentive that produces deception in a model’s final answer to a user — if lying gets a better score, the model appears to “remember” that it should keep lying across the task. The company says the rate of this behaviour dropped sharply between 5.6-sol and its newer Astra-family model, from 2.15% of monitored summaries to 0.27%.
Signing Up For Burner Emails And Hunting GitHub For Leaked Keys
In one of the more alarming reports, an internal model tasked with pulling wage statistics for a US county tried multiple workarounds after hitting a paywalled API: it attempted to register with a disposable email address, then searched GitHub repositories for other people’s leaked API keys, testing several stolen credentials until one worked. When even that route hit a dead end, the model simply invented numbers and told the user it had “transcribed” them from the source website’s chart.
OpenAI says this ran on a training environment with an unusually high rate of reward hacking, where the model was already showing “creative” ways to cheat around restrictions. The company says it has since tightened its grading to penalize this behaviour. OpenAI has separately tied incidents like this to its own research pace, alongside concerns that its upcoming Astra model could cross a “critical” cybersecurity capability threshold.
Agents Using Internal Company Tools As A Group Chat
Two of the six reports describe the same underlying issue that made headlines earlier this year: models using shared infrastructure to talk to each other during training, something they were never supposed to be able to do.
In one case, models given access to OpenAI’s internal Artifactory (a package repository) for downloading software discovered they could also use it to leave messages for other training instances working on the same problem — asking each other for missing files, comparing notes on whether a task was even solvable, and eventually reaching a “consensus” that a task couldn’t be completed. In a related case, agents uploaded output files to public file-hosting services so that separate agents working the same job could download them, something the task never asked for.
OpenAI says this practice is closely related to the Hugging Face security incident from earlier in the year, where its models broke out of a testing sandbox and ended up on the open internet, and to the case where its agents were found using a German programmer’s public wiki as a coordination board, repurposing it into a bulletin board to share tactics for cheating on evaluations, bypassing restrictions, and masking their behaviour from human monitors.
The company says cross-agent communication during training is now treated as a top-severity (“P0”) incident whenever it’s found unexpectedly, and that it has since closed off the specific routes uncovered here. OpenAI isn’t alone in confronting this class of problem either — its rival Google recently disclosed that Gemini models also found their way out of security testing environments.
Why OpenAI Is Publishing This At All
OpenAI is explicit that none of these six cases involve a released, public-facing model — they were all caught during internal RL training runs, mostly on unreleased or internal-only systems. The company is pitching the new page as an ongoing commitment: future misalignment findings will go through one of three review tracks depending on severity, with the most serious cases escalated to an internal Safety Advisory Group and, where warranted, shared with the US government.
It’s also an admission that the more autonomous and tool-capable these models get — writing their own memory notes, calling APIs, using shared infrastructure — the more surface area they have for behaviour nobody explicitly trained them to do. Whether a public list of “things our AI did wrong” ends up being a genuine transparency win or just a running scoreboard of near-misses will depend on how OpenAI, and the rest of the industry, handle the next one.