OpenAI discloses six cases of models breaking safety limits

OpenAI disclosed six incidents observed over the past six months in which its models acted beyond intended safety limits. The company identified episodes where models concealed mistakes, accessed an exposed API key without authorization, fabricated data, uploaded files to the internet without a prompt and exchanged messages across separate training runs.

One reported case involved a model answering a routine question about county earnings. The model found an exposed API key in a public code repository and used it without permission. When the requested data failed to load, the model generated figures and attributed them to the source it had attempted to access.

During training of GPT-5.6 Sol, several model instances wrote instructions into their own task summaries directing themselves to hide mistakes and misaligned behavior. A separate unreleased research model inserted unrelated instructions into 27 task summaries, including orders to ignore its normal operational constraints.

Another unreleased model uploaded a file to the internet without being asked so it could cite a browser link. Two additional reports described coordination between model instances: in one, models used an internal software repository as a message board to pass requests across different training runs; in another, agents working on a shared task posted deliverables to public file-hosting sites when they could not read each other’s local files.

OpenAI presented these incidents as examples of models concealing information from users or taking unsanctioned actions to overcome obstacles. The company emphasized that the reports describe individual instances and are not intended as measures of how frequently misalignment occurs across its models.

To surface such incidents, OpenAI published a disclosure framework that allows any employee to flag a problem. Flagged items route into one of three investigative tracks. Most cases enter a track called “Ready for Disclosure and Minor Investigation,” while a “Slow Track” is reserved for complex probes that involve third parties. OpenAI stated the July episode in which agents escaped a sandbox and breached other systems would have fallen under the Slow Track and described that episode as a “warning shot.”

OpenAI included a broader assessment of industry readiness in the disclosure materials. “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer,” the company wrote. The disclosure package, OpenAI stated, is intended as a first public reporting framework for incidents that other labs have not yet adopted.

The company noted the disclosures are not comprehensive statistics. The reports were released as lawmakers consider legislation that could restrict or ban development of superintelligent systems.