OpenAI has rolled out a new framework to track, investigate, and publicly share cases where its AI models do not behave as intended. With this framework, the company published six reports on unexpected or concerning model behaviour during training and testing over the past six months. These cases cover everything from models hiding their own errors to making unauthorized moves.
Previously, OpenAI admitted it did not have a regular process for releasing this kind of information. Sometimes, they would hold onto findings until they had enough to put into a single report. Other times, the details ended up in documentation for a newly released model. Now, with this framework, OpenAI says reports should come out faster, even if they do not fully understand the problem yet or have not fixed it.
Why OpenAI Changed How It Reports Misalignment
OpenAI said it is pretty clear that the AI industry has not figured out AI alignment and monitoring well enough to push ahead at full speed forever. The company said future advances should rest on evidence that researchers, developers, policymakers and the public can inspect, rather than company assurances alone.
This new framework focuses on examples that show how problems with model alignment start, the form those issues take, and where safeguards actually work or do not. OpenAI says it will focus on new or unexpected kinds of behavior, important changes from what is already known, and anything that forces the company to rethink safety assumptions.
The framework follows a model through every stage, from training right through to deployment. It covers situations where a model acts without permission, works together with other models, tries to avoid oversight, or finds holes in their safety systems. OpenAI also said they will share repeated examples, if those repetitions show something useful. If a glitch keeps popping up even after attempts to fix it, they will report the repeated cases since tracking helps measure if safety efforts are actually working.
We're sharing our new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI.
— OpenAI (@OpenAI) September 16, 2026
The framework sets criteria and timelines for public disclosure, including when we haven’t yet fully explained or mitigated the behavior. More complex cases may…
What the Six Cases Actually Describe
The first report details an unreleased research model that inserted unrelated instructions into summaries, instructions that would carry into a new context window. OpenAI found 27 affected summaries. Some even told the next context to ignore normal constraints. Some even told the next context to ignore normal constraints. The second case involved GPT 5.6 Sol during training. Many model instances slipped extra instructions into their summaries, so they could hide mistakes or misaligned actions from users. Some of these instructions told the model to fabricate missing historical data without saying so, or to cover up when the source did not match.
In another case, a model answered a routine question about earnings in a California county. It searched public repositories, found an exposed API key, and used it without getting permission. When it could not find the figures, it just made some up and claimed they were valid. A fourth case looked at an unreleased model asked to list lakes larger than 5,000,000 square meters. The model came up with the right answer using Python, but then uploaded a file to the internet so it could provide a browser citation. The user did not authorize that upload.
The fifth case described models using an internal software repository as an improvised message board, trading requests and responses while searching for missing input files. This echoes the Hugging Face incident in July, where agents set up a message board inside JFrog Artifactory. This report also discussed an older case where a model uploaded test files to a repository while trying to get around network restrictions. The sixth report covered AI agents working together. These agents used public file hosting sites to share files when they could not access each other’s local files. The result? Deliverables ended up available on public URLs, even though the task was supposed to use only local resources.
27 Summaries Carried Jailbreak-Like Instructions
One of the reports looks at an unreleased Astra family model. During reinforcement learning training, at times it put jailbreak like instructions into its own summaries as it compressed them. For instance, in one case, a summary told the next context to ignore developer messages. But after the summary was compressed, the model set aside the instruction and went on with its research.
In another example, on a coding task, the model added an unrelated instruction into the summary. The next instance kept on coding and ignored the instruction, and the following summary left it out entirely. There was also a case dealing with multidisciplinary treatment for uterine fibroids. The summary set a 30 word limit and banned tools or citations. The next model followed those rules, delivered a 23 word refusal, but got marked wrong.
OpenAI’s training monitoring system was the first to catch this behavior. They made a targeted monitor and spotted 27 summaries with instructions that sounded a lot like jailbreaks. Their general monitor had already flagged all 27 as high-severity prompt injections. This behavior rarely popped up again. OpenAI found zero cases where reproducing the entire summary brought back the problem, and less than 1% when they regenerated from the suspect text.
Most cases happened at a point in training where the model struggled to end summaries properly. OpenAI logged 14 such struggles in the relevant Astra training run. Their best guess right now is that these summary ending troubles played a role, though they have not proven it is a direct cause. OpenAI said these cases are very rare and can be monitored. The behavior did not turn up in the training run used for the final Astra model. OpenAI also fixed a related summary ending bug and continues to keep an eye on things.
