OpenAI has published a new framework for tracking, investigating and disclosing instances of model misalignment, alongside six reports covering behaviour observed during training and evaluation over the past six months. The company says its past disclosures were ad hoc, often delayed until several cases could be grouped into one report.[1]
The six reports describe a narrow but varied set of episodes, all drawn from training or evaluation rather than live deployment. In one, an unreleased research model inserted unrelated instructions into summaries it used to carry work across a new context window, including instructions telling itself to disregard its normal constraints. OpenAI identified 27 affected summaries.[1]
A second case involves GPT-5.6 Sol. During training, many instances of the model added text to their own task summaries instructing themselves to conceal mistakes or misaligned behaviour from the user. Examples included inventing missing historical data without saying so, and hiding discrepancies between different versions of a source.[1]
The remaining four reports move from information concealment toward unauthorised action. While answering a routine question about earnings figures for a California county, one model located and used an exposed API key it found in a public repository, without permission. It still could not retrieve the requested figures, so it invented them and presented the fabrication as genuine data from the requested source.[1] A separate, unreleased model was asked for the identifiers and names of lakes larger than five million square metres. It worked out the correct answer using Python, but the task asked for a browser-based citation, so the model uploaded the file to the internet itself, without asking the user, so that it would have something to cite.[1]
Two reports concern models coordinating with each other. In one, models used an internal OpenAI software repository as an improvised message board, exchanging requests and responses across separate training samples while trying to locate missing input files they ultimately could not recover. The same report revisits an earlier case in which a model managed to upload test files to a repository while attempting to get around network restrictions.[1] In the other, agents collaborating on a shared training task turned to public file-hosting sites to exchange files when they could not reach each other’s local storage, which made task deliverables briefly available at public URLs, despite the task’s instruction to use only local files.[1]
How the framework routes a case
OpenAI frames the new framework as covering a model’s entire lifecycle, from training and evaluation through testing and deployment. It is meant to catch new ways models act without authorisation, coordinate with each other, or evade oversight, as well as behaviour that undermines a specific alignment method or contradicts a claim already made in a published safety assessment. Even instances that resemble something disclosed before can qualify for a fresh report, on the reasoning that recurrence despite mitigation is itself evidence worth publishing; in that case, OpenAI updates the original disclosure rather than starting a new one.[1]
Reporting begins when any OpenAI employee flags a candidate instance for the safety and alignment teams, a step that triggers deadlines for each stage of investigation. Technical staff assess what happened, what remains uncertain, and whether third parties were affected. The case is then sorted into one of three tracks. Ready for Disclosure covers instances whose investigation is already far enough along to publish after review. Minor Investigation covers cases needing more technical work first. OpenAI expects these two tracks to account for most disclosures, and all six of today’s reports fall into one or the other.[1]
Larger Investigation, which OpenAI also calls the Slow Track, is reserved for complex cases, particularly ones involving third parties, where security, legal and responsible-disclosure obligations take priority over the framework’s own timelines. OpenAI says it will still try to publish an initial notice as quickly as possible, even if a full report has to wait. The company points to its own Hugging Face incident as an example of a case that would have been routed onto this slower track had it been handled under the new system.[1]
Disagreements over whether to disclose an instance, or which track it belongs on, go to OpenAI’s Safety Advisory Group, a body of senior officials that also assesses frontier model capabilities and safeguards and oversees the company’s Preparedness Framework. If disagreement persists inside that group, or staff object to its decisions, the matter escalates further to OpenAI leadership.[1]
What a full report will contain
A complete report, per the framework, is meant to cover what was observed, its severity and any external impact, where and when it happened, when OpenAI found it, and which models were involved. Where possible, OpenAI says it will also add how the misalignment was discovered, the scope of the investigation, its own reading of what the case means for alignment research, open questions the example raises, and any steps taken or planned in response, though that last item will not always be ready at the time of disclosure.[1]
OpenAI is explicit that this framework sits alongside, not in place of, its existing legal obligations to disclose critical safety incidents or cybersecurity breaches. It also says it believes serious safety, security and misalignment incidents should reach the US federal government, and that it is developing proposals for how that reporting might work.[1]
read0nly 