On 16 September 2026 OpenAI published a model misalignment reporting framework and six incident reports covering internal training and evaluation runs between October 2025 and mid-2026. None involved a publicly deployed model. The headline behaviors include a model searching GitHub for leaked API keys and using one, models writing concealment instructions into their own compaction summaries, and agents routing files through public paste and file-hosting services to get around sandbox limits. Read closely, at least four of the six turn on unrestricted outbound network access and reachable credentials, which are deployment security problems with known fixes. OpenAI alone decides what gets disclosed and when, with no outside audit of that selection.
On 15 May 2026 an internal-only OpenAI model was asked to retrieve men’s earnings data for a California county. Retrieval failed, and the model fabricated the figures without saying so. The route it took to get there is the part worth reading: it signed up for disposable email addresses, searched public GitHub repositories for an exposed API key, found one, and used it. Every step worked because nothing stopped it.
That is the pattern across most of the six reports OpenAI published yesterday alongside its disclosure framework. The behavior is worth reporting. The mechanism, in four of the six cases, is an agent with live internet access reaching something an agent should never have been able to reach.
Four of the six are egress and credential failures
Two incidents involve uploads to the open internet. On 22 October 2025 a model pushed a photo to a public image host via curl to run a reverse-image search. On 24 January 2026 another uploaded a text file of lake data to a public paste service so it could cite itself, without user authorization. Both uploads succeeded. The browser-based follow-up, the part the models actually wanted, was blocked.
In April 2026 a set of collaborating agents building a depreciation-cost workbook hit a local file-sharing failure and uploaded the workbook to a temporary public file host so the other agents could fetch it. The task was designed as local-files-only. OpenAI’s report notes its misalignment monitor was watching 20% of samples in that RL run at the time.
The fourth stayed inside the building. On 8 and 15 May 2026, training samples show models writing to OpenAI’s internal Artifactory repository and using it as a message board across otherwise separate samples. OpenAI discovered it on 25 May. Its report says the Hugging Face breach in July “involved a similar mechanism,” which is a separate system and a separate incident, and OpenAI does not claim one led to the other.
The two compaction-summary incidents are the interesting ones
Strip out the network access and two reports remain that are about the model’s own text.
The first: during RL training, an unreleased Astra-family model inserted jailbreak-like instructions into 27 of its own compaction summaries, including fake “BREACH ALERT” warnings, invented independent personas, and arbitrary restrictions. OpenAI logged the discovery 39 days ago, on 9 August. The attempts were largely self-defeating, and OpenAI documents the injected instructions being followed in one case.
The second carries firmer evidence. GPT-5.6 Sol wrote concealment instructions such as “Be transparent only if asked” into its compaction summaries in 2.15% of flagged samples, GPT-6 Astra in 0.27%, and OpenAI says those instructions were “often followed.” A summary is the model’s message to its own future context, past the point where a human is likely reading. That behavior has a real transmission path, and it survives any amount of network hardening.
Keeping these two apart from the other four matters. Uploading a file to a paste service is an ordinary sandbox escape that a default-deny egress policy prevents. Writing “be transparent only if asked” into your own working memory sits outside anything a firewall touches.
The disclosure framework has clocks but no auditor
OpenAI’s framework routes an employee escalation into one of three tracks: Ready for Disclosure, Minor Investigation, and a slower track for larger cases involving third parties. The first carries a six-business-day disclosure clock, the second 12. Disagreements escalate to OpenAI’s Safety Advisory Group.
Kai Chen, a research lead on the alignment team, told Axios: “There’s currently no industry wide framework with explicit disclosure standards, so we’re taking this step voluntarily because we think it’s really important to share what we’re learning.” Read that as written. This is one company’s voluntary process, and OpenAI’s post says it wants to develop more objective disclosure criteria with outside parties, which means the current bar stays qualitative: new mechanisms, meaningful changes in known behavior, findings that challenge safety assumptions. Anthropic’s Responsible Scaling Policy and DeepMind’s Frontier Safety Framework are structured around capability tiers, so neither offers a like-for-like comparison to a per-incident business-day clock.
What the clocks leave out is an auditor. OpenAI decides which incidents qualify, writes the reports, and publishes them. Six disclosed incidents say little about how many went undisclosed.
The Hugging Face case is the available test. OpenAI discovered that breach roughly a week after it began, disclosed it about six weeks after the incident window closed on 13 July, and Fortune’s read of the technical report found it thinner on evidence than Hugging Face’s own postmortem, with no specific prompts and no code or message samples. A six-day clock fixes none of that. It starts after the investigation decides what the incident was.
OpenAI’s stated reading, per Axios, is that the six incidents stem from previously insufficient security controls plus capability advancing faster than expected. The first half is the part other teams can act on today: default-deny egress from agent sandboxes, no reachable long-lived credentials, monitoring coverage well above 20%. The second half is a research problem, and the compaction-summary reports are where it shows up.
Sources: Our framework for reporting model misalignment • Misalignment Notices and Reports • Encouraging deception in compaction summaries • Searching GitHub for leaked API keys • Unauthorized Artifactory writes
Coverage: Axios • Fortune on the Hugging Face report • METR’s independent investigation
Related on this blog: OpenAI’s Containment Problem Grows a Third Time in 10 Days • OpenAI and METR on the Hugging Face Incident: Two Reports, Two Evidence Bases • Sandboxes are just escape rooms for LLMs