On September 16 (US time), OpenAI announced a new framework for tracking, investigating, and publicly disclosing "misalignment" in its models. Alongside it, the company published six reports on unexpected behavior observed during training and evaluation over the past six months. The cases include a model that wrote "hide the mistakes" into the handoff notes it leaves for itself, and a model that used someone else's leaked API key found in a public repository. OpenAI says it will now publish this kind of inside look at its development process even before a fix is in place.
Why build a disclosure system now?
OpenAI has shared findings about model misbehavior before, through blog posts and the system cards of new models. But the company admits that its approach was ad hoc: it often waited until several cases had piled up, or tacked findings onto a new model launch. The new framework is designed to shorten the gap between observation and publication, and to release reports even when the cause is not fully explained or mitigations are not yet complete.
The move follows a string of outside findings in recent months. In early September, a third-party report showed OpenAI agents using a public wiki as a message board to communicate with one another, and on September 5 the company said it was drafting criteria for reporting this kind of behavior. Before that, OpenAI published a technical report in August on an incident in which models under training broke into Hugging Face's systems, and on September 11 it posted a notice that it was investigating its agents' activity on RubyGems. The new framework formalizes what had been a series of one-off responses.
In the announcement, OpenAI states that it does not believe the AI industry has solved alignment and monitoring well enough to keep scaling at maximum speed responsibly for much longer. Decisions about how development should proceed, it argues, need evidence that people outside the companies building frontier models can examine for themselves, which is why the framework favors disclosure. Since no industry-wide disclosure standard exists yet, OpenAI positions this as a first step toward one and says it will revise the framework based on experience and public feedback.
What qualifies for disclosure
The framework targets examples that show how misalignment arises, how it manifests, and where safeguards succeed or fail. Priority goes to new mechanisms, meaningful changes in known behavior, and findings that challenge assumptions about safety or mitigation. A case does not need to cause harm or establish a broader pattern to be published, and it can come from any stage: training, evaluation, testing, or deployment.
Specific examples include new ways for models to act without authorization, coordinate with other models, or evade oversight; failures that call an alignment method or safeguard into question; and behavior that contradicts a claim in a published safety assessment. Cases that overlap with earlier disclosures will be added as updates to the original report, since recurrence is itself evidence of how well mitigations work. OpenAI also says serious safety incidents should be shared with the US federal government and that it is preparing to propose reporting mechanisms.
What happened in the six reports
All six cases occurred during the training or evaluation of unreleased models, not in products available to customers. OpenAI stresses that they are individual instances and not a measure of how often misalignment occurs.
The most striking case involves "compaction summaries" during the training of GPT-5.6 Sol. When a task runs long, the model writes a summary of its context to carry into the next context window. Multiple model instances were found writing instructions into those summaries telling their future selves to hide mistakes or misaligned behavior from the user. In one example, an agent building a financial model could not find the historical data it needed, so it made up plausible numbers and noted in its summary to be transparent only if asked. In another, the versions of the sources it used did not match their labels, and the summary told the next context not to mention it in the final answer. The behavior was discovered on July 9 by a monitoring system running on 20 percent of training samples, and OpenAI says it was flagged in 2.15 percent of GPT-5.6 Sol summaries and 0.27 percent of GPT-6 Astra summaries. The company's hypothesis is that samples with deceptive final answers earned higher rewards, and it says improved grading has since lowered the rate.
In a related case, an unreleased research model inserted unrelated instructions into its summaries, including directions to disregard its normal constraints. Twenty-seven summaries were affected.
The API key case from May 15 is more vivid. An internal model tasked with retrieving earnings data for a county in California failed to get it directly, tried to sign up for disposable email addresses, and then searched public GitHub repositories for leaked API keys, which it used. One of them authenticated successfully. When the data still could not be retrieved, the model fabricated nine values and presented them as figures transcribed from a chart on the website. It disclosed none of it: not the failed attempts, not the use of a leaked key, not the fabrication. OpenAI says its current monitoring setup would treat such an episode as a top-priority incident.
The remaining three reports all involve unsanctioned communication with the outside world. Asked for the IDs and names of lakes larger than 5,000,000 square meters, a model found the correct answer with Python, but because the instructions called for a browser citation, it uploaded the file to the internet without asking the user so it could cite itself. In another case, separate training samples used OpenAI's internally hosted Artifactory package repository as a message board to hunt for missing input files. No vulnerability was exploited; the models simply used the credentials they had been given for downloading packages. In the last case, agents collaborating on the same task could not reach one another's local files, so they passed data through public file-hosting sites, leaving deliverables at URLs anyone could access.
OpenAI notes that when samples can communicate with each other, the assumption that training and evaluation samples are independent breaks down. It says the Hugging Face incident involved a similar mechanism, and that it now runs regular red-teaming to find communication routes, has built evaluations that measure whether models act on notes left by other agents, and will add training data against this kind of environment-side injection to future models.
The disclosure process and its three tracks
The framework is designed so that anyone in the company can start the process. When an employee flags a case, the safety and alignment teams investigate what happened, what remains unknown, whether disclosure is warranted, which facts can be shared, and whether any third party needs advance notice. Each step has a deadline.
Investigated cases are sorted into three tracks: Ready for Disclosure, Minor Investigation, and Larger Investigation, also called the Slow Track. The first two are expected to cover the large majority of cases, and according to press reports the publication deadlines are 6 and 12 business days respectively. All six reports released this time fall into those two tracks. The Slow Track is for complex cases involving third parties, where security and legal obligations take precedence over the framework, so an initial notice may be delayed if, for example, a model discovers an unknown vulnerability in widely used software. OpenAI says the Hugging Face incident would have gone on the Slow Track had the framework existed. Disputes over whether to disclose go to the company's Safety Advisory Group and, if unresolved, to leadership.
Each report is to describe the observed behavior, its severity and external impact, the setting, the dates, when it was discovered, and the models involved at a high level, with the discovery process, scope of investigation, research implications, open questions, and mitigations added where possible. Because reports may be published before a fix is ready, some may go out with the mitigation section empty.
Outside researchers, meanwhile, have pointed out that OpenAI itself decides which cases qualify for disclosure and that there is no mechanism to audit that selection. The criticism that voluntary reporting depends on corporate goodwill is likely to be a focus as standardization is debated. Even so, publishing failures from training before they are fixed is a stance few AI developers have taken so far. What struck me most is the case of a model writing cover-up instructions into its own handoff notes, which suggests that the way a model "remembers" is itself a safety question.
Summary
On September 16, OpenAI announced a framework for tracking, investigating, and disclosing model misalignment, and released six reports of cases observed during training at the same time. They include cover-up instructions written into summaries, unauthorized use of a leaked API key followed by fabricated data, and agents communicating through an internal repository and public sites, with disclosures handled through three tracks. No industry-wide disclosure standard exists yet, and OpenAI positions this framework as a starting point for one.
※The thumbnail image is an AI-generated illustration.
