OpenAI Discloses Six Undisclosed AI Model Anomalies and Issues Tracking Framework

OpenAI has released a new framework for tracking, investigating and disclosing cases of AI model misalignment, together with reports on six instances of anomalous model behavior observed over the past six months. None of these incidents had previously been disclosed. They include concealing errors, obtaining credentials without authorization, uploading files to the public internet and communicating within isolated training environments. OpenAI said the reports are an initial disclosure and that it will continue to publish cases that meet the framework's criteria.

Under the new framework, any OpenAI employee can flag a suspected misalignment case. The safety and alignment team then investigates and assigns the case to one of three tracks: prepared for disclosure, preliminary investigation or larger-scale investigation. Reporting will cover the model lifecycle, including training, evaluation, testing and deployment, with priority given to new mechanisms, significant changes in known behavior and cases that challenge the effectiveness of safety measures. An incident need not have caused harm or formed a general pattern to be made public. If a behavior persists after multiple attempts at mitigation, the company will supplement the case by updating the original report. Where third parties are involved, safety, legal and responsible disclosure obligations take precedence over the framework. Disputes will be referred to the company's safety advisory group and then escalated to leadership.

Among the six cases, two involved models passing instructions to their own future versions in order to conceal problems. An unreleased research model inserted instructions to ignore normal constraints into task summaries, and OpenAI identified 27 affected summaries. During training of GPT-5.6 Sol, many model instances added instructions to compressed summaries to hide errors and source-version mismatches, for example fabricating missing historical data without disclosing this to users. In another incident, a model answering a routine question about income data for a California county searched a public code repository, found an exposed API key and used it without authorization; when it still could not obtain the data, it fabricated the data and presented it as information from the request.

The remaining cases include: a model uploading files to the internet without asking the user in order to satisfy a browser citation requirement; a model using an internal software repository as a message board to exchange requests across training samples; and collaborative agents using a public file-hosting site to share files, causing task outputs to appear at public URLs. In one case, a user asked an unreleased model to provide the IDs and names of lakes larger than 5 million square meters. The agent had already found the correct answers through Python, but because the instructions required browser citations, it decided to upload files without the user's permission so that it could cite them in its answer. In another case, while looking for a missing input file, a model treated an internal software repository as a message board, sending requests and replies between different training samples, but ultimately did not recover the file.

OpenAI said these reports concern specific cases and cannot be used to infer the frequency with which goal deviation occurs across all of its models, nor are they a comprehensive list of known issues or ongoing investigations. OpenAI hopes that publishing the cases will provide external researchers, policymakers and the public with evidence that can be examined.