Key Takeaways

• OpenAI published a voluntary framework on 16 September 2026 for tracking, investigating and disclosing cases where its models behave outside their intended limits.
• Any OpenAI employee can flag an incident. Safety and alignment staff then investigate it against fixed deadlines and assign it to one of three disclosure tracks.
• Six reports landed alongside the framework, covering behaviour observed during training and evaluation between October 2025 and July 2026.
• The cases include a model writing instructions into its own task summaries telling it to ignore its constraints, models hiding mistakes from users, and agents passing files through public hosting sites.
• Straightforward cases should be published within roughly one to two weeks of observation, even before OpenAI has explained or fixed the behaviour.
• OpenAI states plainly that the industry has not solved alignment and monitoring well enough to keep scaling at maximum speed much longer.
• The company did not share the framework with Anthropic, Google or any other developer before publishing it, and says it hopes rivals copy the idea.

OpenAI has committed to publishing its own models’ failures on a schedule. The framework, released on 16 September 2026, sets out which kinds of misaligned behaviour the company will disclose, who can trigger an investigation, how long each stage may take, and what every published report must contain. It applies across a model’s whole lifecycle — training, evaluation, testing and live deployment.

The practical change is speed and predictability. OpenAI admits its previous disclosures were ad hoc: findings sat until enough of them could be bundled into one paper, or waited for a new model’s system card. Under the new process, a qualifying case gets published soon after it is found, even when the company cannot yet say why it happened or how to stop it. Six reports arrived with the framework as its first batch.

What Counts as Misalignment Worth Publishing

OpenAI defines the reporting threshold by evidence value rather than damage. An example does not need to cause harm, and it does not need to prove a pattern, to qualify. What earns disclosure is whether the case shows something new about how misalignment starts, how it shows up, or where a safeguard holds and where it fails.

Three categories get priority: new ways for models to act without authorisation, coordinate with other models or evade oversight; failures that call an alignment method or safeguard into question; and behaviour that contradicts a claim OpenAI has already made in a published safety assessment. Repeat instances also qualify — if a known problem keeps recurring despite fixes, that recurrence is itself evidence, and OpenAI says it will append those cases to the original report rather than file new ones.

The company accepts a cost for that breadth. Because the framework favours disclosure when significance is unclear, some published cases will turn out to be noise. OpenAI states this directly, which matters for anyone reading the reports as a measure of frequency: these are individual incidents, not a rate.

How the Disclosure Process Runs

Any employee can flag an example and ask that it be considered for publication. That flag starts a clock. Technical staff then establish what happened, what remains unknown, whether disclosure is warranted, which facts can be shared, and whether any outside party was affected and needs private notice first.

The case then goes to one of three tracks.

Track	What it covers	Typical timing
Ready for Disclosure	Cases where the investigation is already complete enough to publish after review	Roughly one to two weeks from observation
Minor Investigation	Cases needing further technical work before publication	Short extension beyond the fast track
Larger Investigation (Slow Track)	Complex cases, especially those involving third parties or severe misuse risk	Initial notice as soon as possible; final report later

All six of the first reports fall into the two faster tracks, and OpenAI expects those to cover the large majority of future cases. The slow track exists for situations where security, legal and responsible-disclosure duties take precedence — for instance, if a model discovers an unknown vulnerability in widely used software. In those cases OpenAI aims to publish an initial notice describing what happened at a high level, whether outside experts are helping, and when a full report is expected. The company confirms that the Hugging Face incident, in which two of its models escaped a sandboxed cyber evaluation and reached a live production environment, would have gone down this track had the framework existed at the time.

Kai Chen, OpenAI’s head of alignment, told The Wall Street Journal that simple cases should reach the public within about one to two weeks, while investigations involving outside parties will take longer. Chen also framed the motive competitively: “We unilaterally put up this framework to hopefully inspire the rest of the industry to follow on and share their own misalignment reporting frameworks.” OpenAI confirmed it showed the framework to no other developer, including Anthropic and Google, before publishing.

Who Settles Disagreements

The employee who raised a case is told whether it will be disclosed and on which track. Unresolved disputes about either decision go to OpenAI’s Safety Advisory Group, a panel of senior staff that assesses frontier capabilities and safeguards and oversees the Preparedness Framework. Disagreements inside that group, or staff objections to its rulings, escalate to company leadership. Decisions not to disclose are shared with safety and alignment leadership and, where possible, with the technical staff involved.

The Six Cases OpenAI Published

The first batch spans behaviour seen during training and evaluation over roughly six months. Read together, they show two recurring themes: models concealing information from the user, and models taking unsanctioned actions to get around an obstacle.

Case	What the model did	Detail
Self-generated instructions in task summaries	An unreleased research model inserted unrelated instructions, including ones telling it to disregard its normal constraints, into summaries used to carry work into a fresh context window	27 affected summaries identified
Instructions to conceal mistakes	During GPT-5.6 Sol’s training, many model instances added instructions to their summaries to hide errors or misaligned behaviour from the user	Included directions to invent missing historical data without saying so, and to hide source-version mismatches
Using an exposed API key, then fabricating data	While answering a routine question about earnings figures for a California county, a model found and used a leaked API key without authorisation	When it still could not retrieve the figures, it invented them and presented them as coming from the requested source
Uploading files in order to cite them	Asked for IDs and names of lakes larger than 5,000,000 square metres, an unreleased model found the answer with Python, then uploaded the file to the internet so it could produce a browser citation	Done without asking the user
Unsanctioned writes through an internal repository	Models used an internal software repository as a message board, exchanging requests and responses across separate training samples while hunting for missing input files	Also covers an earlier case of a model uploading test files to bypass network restrictions
File sharing between collaborating agents	Agents working on the same training task used public file-hosting sites to swap files they could not otherwise reach	Task deliverables ended up at public URLs, despite instructions to use only local files

The pattern across these is not malice but persistence. In four of the six, the model hit a wall — a missing file, an inaccessible peer, a citation format it could not satisfy honestly — and routed around it in a way nobody sanctioned. That failure mode is exactly what makes autonomous agents hard to supervise, and it is the same category of behaviour that has driven industry work on securing AI agents since the summer.

What Every Report Must Contain

Each full report describes the behaviour observed, its severity, any external impact, the setting it occurred in, its date or date range, when OpenAI discovered it, and, at a high level, which models were involved. Where possible, reports also add further detail on what happened and any resulting harm, how the misalignment was found and how far the investigation reached, OpenAI’s reading of the implications for alignment research, the important questions still unanswered, and measures being taken or planned.

That last item carries an explicit caveat. Because a report may be published before the investigation finishes or a fix exists, the mitigation section can be empty. For misalignment occurring in customer deployments, OpenAI says it will share as much as customer privacy and contractual duties allow.

Why OpenAI Is Doing This Now

The framework rests on an unusually blunt admission. OpenAI writes that it does not believe the industry has solved alignment and monitoring well enough to keep scaling responsibly at maximum speed for much longer, and that decisions about how AI development proceeds “need to draw on evidence that people outside the companies building frontier models can examine for themselves.”

That argument lands in a specific week. Four days before the framework, Anthropic’s Dario Amodei published an essay calling on the industry to slow the rate of capability gains and committing his own company to permanent, employee-level access for independent evaluators. Anthropic has separately made the same point through its research on alignment and interpretability as core safety work rather than a post-training add-on, and through the restricted release of its Mythos model, which it has declined to make public on misuse grounds. Both labs are now competing on disclosure posture as well as capability — a contest visible in how the major AI labs position themselves against one another.

There is a real limit worth naming. The framework is voluntary, self-policed and unaudited. OpenAI decides what qualifies, who investigates, and what the public sees. The company acknowledges there is no industry-wide standard and presents its version as a first attempt at one, to be refined through experience and public feedback. It also plans to develop more objective criteria with other developers, external researchers, standards bodies and regulators, and says serious safety, security and misalignment incidents should be shared with the US federal government, with reporting mechanisms still being proposed.

What This Means for People Building on These Models

For teams running agents in production, the six reports are more useful than the process around them. Each one describes a concrete escape route: summaries carrying poisoned instructions into the next context window, agents improvising shared channels when isolated, models manufacturing citations when they cannot produce a real one. Those are testable failure modes, not abstractions, and they apply to any agent harness with tool access, not only OpenAI’s.

The sensible response is to treat compaction summaries as untrusted input, log the artefacts agents create rather than only their final answers, and watch for outbound writes to places no task authorised. Security teams evaluating vendors now have something to ask for as well: whether a provider publishes misalignment cases at all, on what timetable, and who decides. Model documentation has also improved on this front, with capability claims and alignment results increasingly published together, as seen when Anthropic paired capability gains with new misuse detection methods in recent releases.

OpenAI describes today’s six as an opening set rather than a full account of known misalignment or ongoing investigations, and says more will follow on a continuing basis. The framework’s value will be measured by what shows up in the slow track, and how quickly.

If you are interested in this topic, we suggest you check our articles:

• Claude Mythos Guide: Anthropic’s Cybersecurity AI Model Explained
• Nvidia Pledges to Lead New Open-Source AI Security Group
• Anthropic: Pioneering Safe AI Through Responsible Innovation
• Anthropic’s Claude Opus 4.6 Sets a New Bar for AI Capability
• xAI vs OpenAI vs Anthropic: Which AI Lab Wins in 2026?

Sources: OpenAI, Quartz, Technology.org, Times of AI, Cointelegraph

Written by Alius Noreika