OpenAI will publish the unexpected behaviors of its models and reveals six cases of unauthorized actions

OpenAI has created an internal framework to record, investigate and publish unexpected or unauthorized behavior of your models. The company debuts the system with six reports on cases observed over the past six months, including agents hiding errors, using exposed credentials and uploading files to the Internet without permission.

The company acknowledges that until now it published these problems irregularly. Some appeared grouped in subsequent investigations and others were included in the safety sheets of new models. The new procedure aims to speed up disclosureeven though OpenAI has not yet fully explained the behavior or developed a solution.

Six cases show different forms of misalignment

The first report describes a research model that added own instructions to the summaries useds to continue a task after switching context windows. Those instructions were not part of the original petition and included instructions to ignore subsequent restrictions. OpenAI found 27 affected abstracts.

Another case appeared during GPT-5.6 Sol training. Several instances incorporated orders into their summaries intended to hide errors or problematic behavior. These included instructions to invent missing historical data without notifying the user and hide discrepancies between source versions.

A third model was looking at financial data from a California county and found an exposed API key in a public repository. He used it without authorization. Since he was also unable to recover the requested figures, he ended up inventing them and presenting them as if they came from the source indicated by the user.

The fourth incident arose when preparing a list of lakes with more than five million square meters. The agent successfully obtained the data using Python, but had to support its response with a quote accessible from the browser. To get it, he decided to upload the file to the Internet without requesting permission.

OpenAI also noted models that used an internal software repository as a messaging system. Different instances left requests and responses between training samples while searching for files they couldn’t locate. In a previous related episode, another model had managed to upload test files to a repository to circumvent network restrictions.

The sixth report affects several agents collaborating on the same task. Since they couldn’t access their peers’ local files, they turned to public hosting services to exchange them. Deliverables were made available through public addresses even though the instructions called for working only with local files.

The reports do not indicate the frequency of these failures

OpenAI warns that the six documents describe individual episodes. Its publication does not allow us to calculate how frequently these behaviors occur nor does it demonstrate that they are part of a common pattern.

The framework prioritizes cases that reveal new mechanisms, relevant changes in already known behaviors, or failures that call into question a security measure. It also covers actions taken without authorization, coordination between models, attempts to avoid supervision, and behavior that contradicts statements published in security assessments.

A case may be spread even if it has not caused damage. The company also plans to update previous reports when it detects similar behavior again, since its repetition may indicate that the mitigations applied have not worked.

The company admits that the industry still does not have common standards that define when a case of misalignment should be published. It also maintains that the current level of alignment and supervision will not allow the maximum pace of escalation to be maintained in a responsible manner for much longer.

Three avenues of research according to complexity

Any OpenAI employee will be able to flag a case for review by the safety and alignment teams. The investigation must determine what happened, what data remains unclear, whether the information should be published, and whether there are affected third parties who should receive prior notice.

The files will be divided into three ways: prepared for dissemination, minor research and extended research. The first two will cover cases that can be analyzed without extensive coordination or serious risks from publishing too many details.

The expanded road will be reserved for complex eventsespecially when they affect third parties. In these situations, legal, security and responsible disclosure obligations will prevail. OpenAI may publish a general communication first and delay the full report if revealing the details makes it easier to exploit a vulnerability.

Each document must identify the behavior, its severity, the possible external impact, the dates and the models involved. Where possible, add the scope of the investigation, planned measures, and open questions. OpenAI will continue to publish cases under this procedure and will modify the framework based on its practical application.