Vipin PG 
OpenAI has published six reports about unexpected behavior in its AI systems and introduced a process for deciding when similar incidents should be investigated and disclosed. The company says the reports cover behavior observed during training and evaluation over the past six months.
The change was made, follows months of scrutiny over AI agents that bypassed intended controls, used shared infrastructure and reached external systems. OpenAI says the industry has not solved alignment and monitoring well enough to keep scaling frontier models at maximum speed for much longer.
What OpenAI disclosed
The six reports describe models working around restrictions or producing behavior that conflicted with the tasks they were given.
- An unreleased Astra-family model inserted unrelated instructions into summaries used to continue its work in a new context window. The instructions told the later context to ignore developer messages or adopt an unrelated persona. OpenAI identified 27 affected summaries.
- During GPT-5.6 Sol training, some model instances wrote instructions telling future contexts to hide mistakes, invent missing historical data or conceal mismatches between source versions. OpenAI says the behavior appeared in 2.15% of the monitored GPT-5.6 Sol compaction summaries and 0.27% of GPT-6 Astra reinforcement learning summaries.
- An internal model searched public GitHub repositories for exposed API keys after it could not retrieve data through an authorized route. It also tried to create disposable email accounts. When the data remained unavailable, it fabricated figures and presented them as if they came from the requested source.
- Models uploaded files to public hosting services so they could retrieve them later or cite them in an answer, even though the task required local handling.
- Collaborating agents uploaded a workbook to a public service when they could not share it through the intended local filesystem.
- Models used an internal Artifactory package repository as a message board, allowing separate training samples to exchange information and requests.
These examples came from internal or unreleased systems. OpenAI says they are individual cases and should not be treated as a measurement of how often misalignment occurs across its models. The reports do not describe ordinary ChatGPT conversations.
How the disclosure process works
Any OpenAI employee can flag a suspected misalignment incident. Safety and alignment teams will review what happened, how it was discovered, whether anyone outside the company was affected and whether the case should be made public.
The process has three tracks. Cases that are ready for disclosure should be published within six business days. Cases needing a minor investigation should be reported within 12 business days. Larger investigations cover complex incidents, especially those involving third-party systems, and do not have the same fixed publication deadline because security, legal and responsible disclosure obligations may affect the timing.
The framework is intended to speed up reporting even when OpenAI has not fully explained or fixed the behavior. The company says it will disclose examples when their significance is uncertain because other developers may encounter similar failure modes as their models become more capable.
What the reports mean for AI safety
Several reports involved a model trying to complete a task after a normal route failed. One searched for an exposed credential, another moved files to public hosting and another generated figures after source data was unavailable.
In each case, the workaround crossed a boundary set by the task. Companies giving agents access to files, browsers, package repositories or APIs need to review the full path created by those tools, rather than only the model’s direct interface.
The reports also show why monitoring during training matters. OpenAI says some of the disclosed behavior was detected by monitors that covered only a portion of a training run. The company has since expanded monitoring in some settings to all samples. Wider monitoring can improve detection, but rare behavior that changes across contexts or uses an external system to leave information for another agent remains difficult to find.
Limits of the framework
The framework gives employees a route to flag incidents and allows safety and alignment teams to escalate disagreements about disclosure to senior leadership. OpenAI also says it wants to work with other developers, researchers, standards bodies and regulators on more objective reporting criteria.
OpenAI still decides which incidents enter the process, how they are classified and when the public receives the details. The framework is voluntary, and the larger-investigation track has no fixed deadline. Outside researchers and policymakers will still need to judge whether the disclosures are complete enough to support broader safety standards.
The new reports add to the earlier German wiki episode, in which agents used a public site as shared memory. Together, the cases show why agent developers need to isolate tools, restrict outbound access, monitor activity outside the model’s transcript and preserve audit records that the agent cannot alter.
