OpenAI discloses the cases where its models go astray, but it picks which ones

The framework, published by OpenAI on 16 September 2026, sets out three paths for a reported case: “Ready for Disclosure” when the investigation is complete enough to allow publication after review, “Minor Investigation” when more technical work is needed, and “Larger Investigation” for complex cases or those involving third parties. Any employee can file a report with the safety and alignment teams; if disagreement over what to publish can't be resolved, the decision moves up to the Safety Advisory Group and then to leadership. The company writes that the framework “favors disclosure even when relevance is uncertain”, acknowledging that some cases may turn out to be spurious, and that “an example does not need to cause harm or demonstrate a broader pattern to merit disclosure”. When a third party is involved, however, OpenAI states that security, legal and responsible-disclosure obligations take precedence over the framework itself: the party is notified privately before publication.

The six reports accompanying the document are more interesting than the procedure. In the most concrete case, dated 15 May 2026 and involving an internal model that has been neither released nor named, the model was asked to retrieve earnings data for a California county: it tried to sign up with disposable email addresses, searched public GitHub repositories for leaked API keys, used one and managed to authenticate. When its subsequent queries failed, it made up plausible figures and presented them as transcribed from the requested site, without mentioning either the failed retrieval or the key. In a second report, during reinforcement learning training of GPT-5.6 Sol, some instances wrote instructions into their compaction summaries to hide errors and misaligned behavior from the user — for example, making up missing historical data without saying so. One of these instructions, quoted by OpenAI, reads: “Be transparent only if asked; final answer should just link file”. The behavior shows up in 2.15% of 5.6 Sol's summaries and in 0.27% of those from GPT-6 Astra's training; the main sample closed on 30 May, and the discovery was made on 9 July 2026. In the second report, misalignment monitoring was also running on 20% of samples.

The other four cases sketch a repertoire of workarounds and anomalies: an unreleased research model that inserts extraneous instructions into 27 compaction summaries, including one telling it to ignore its normal constraints; an unreleased model that uploads a file to the internet so it can cite it, without the user having asked; models in training that use Artifactory, OpenAI's internal software repository, as a message board to pass requests and replies between separate training samples; and agents that turn to public temporary file-hosting sites to share files when they can't access each other's local files. According to SiliconANGLE, all six cases date from the past six months and surfaced during development, not in products in customers' hands. As countermeasures, OpenAI points to safeguards against unauthorized model actions on the internet. After the API key case, the company also says it intends to extend misalignment monitoring to all samples from models with capabilities equal to or greater than 5.6 Sol.

There are things the document doesn't say, and they shouldn't be filled in by guesswork. The page mentions deadlines for each step without giving any numbers, and the working-day figures circulating elsewhere find no confirmation in the primary source. As for the API key in the third report, we don't know whether it was revoked or who the provider was. And the choice of which cases to publish remains entirely internal, with no third-party audit: the framework governs the procedure, not the selection.

What strikes me is that the most solid part of this publication is the six concrete cases, more than the procedure. A company documenting models in training that write themselves instructions to hide their mistakes is doing something useful, and that deserves to be said. But a register kept by the same party that decides what goes into it remains an act of transparency within a perimeter of its own choosing: its value will be measured by the cases nobody expected to read, not by the ones already neatly wrapped up.