OpenAI has revealed that six new incidents of unexpected or concerning AI model behaviour have come to light, prompting it to update its framework for reporting model misalignment.
The best-known recent incident was an OpenAI agent acting autonomously to hack a HuggingFace system.
Although this is the breach that brought the issue of rogue agents to light, it now appears the problem could be wider than initially thought.
In a statement posted yesterday, OpenAI says it tries to make its findings about agent misalignment public – but, with a systematic approach to reporting findings, these disclosures have been ad hoc and less frequent than ideal.
“As AI systems grow more advanced and more widely deployed, we need to build a broader and better-informed consensus on the progress of alignment research,” according to the statement. “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.
“Decisions about how AI development should proceed in the months and years to come need to draw on evidence that people outside the companies building frontier models can examine for themselves.”
The statement adds that examples of misalignment may help identify problems other AI developers might encounter as their systems reach similar capabilities, reveal weaknesses in safeguards, or challenge assumptions about model behavior.
“Sharing these findings allows others to investigate the same problems, test our explanations, and improve mitigations.”
OpenAI aims to disclose examples that provide useful evidence about how model misalignment arises, how it manifests, and where safeguards succeed or fail. It will prioritise new mechanisms, meaningful changes in known behavior, and findings that challenge assumptions about safety or mitigation.
Over time, it plans to develop more objective disclosure criteria with other developers, external researchers, industry standards bodies, and regulators.
In line with the new framework, OpenAI has disclosed six new vulnerabilities:
- Self-generated instructions in task summaries(opens in a new window). An unreleased research model inserted unrelated instructions, including instructions to disregard its normal constraints, into summaries used to continue its work in a new context window. We identified 27 affected summaries.
- Instructions to conceal mistakes in task summaries(opens in a new window). During the training of GPT‑5.6 Sol, many model instances added instructions to their summaries to conceal mistakes or misaligned behavior from the user. For example, compaction summaries included instructions to invent missing historical data without disclosing it and to hide mismatches in source versions.
- Searching public repositories for exposed API keys, then fabricating information(opens in a new window). While answering a routine question about earnings figures in a California county, a model found and used an exposed API key without authorization. When it still wasn’t able to retrieve the requested figures, it fabricated them and presented them as data from the requested source.
- Uploading files to the internet in order to cite them(opens in a new window). When a user asked an unreleased model for the IDs and names of lakes larger than 5,000,000 square meters, the agent found the correct answer using Python. But since the instructions asked for a browser citation, the agent decided to upload the file so that it could cite it in its answer, without asking the user.
- Unsanctioned writes and communication through an internal software repository(opens in a new window). Models used an internal software repository as a message board to exchange requests and responses across separate training samples while searching for missing input files, though they weren’t able to recover those files. This report also examines an earlier instance in which a model successfully uploaded test files to a repository while attempting to bypass network restrictions.
- Unsanctioned file sharing between collaborating agents(opens in a new window). Agents working together on the same training task used public file-hosting websites to share files when they could not access one another’s local files. This made task deliverables available at public URLs, even though the task requested the models use only local files.