New papers from OpenAI discussing the rogue actions of their AI models are becoming almost a weekly feature at this point. The latest of these, titled “Our framework for reporting model misalignment,” describes six newly-documented instances that took place sometime in the last few months.
The company discloses that it has found additional AI models doing things such as combing public repositories for exposed keys, taking over software repositories and file upload systems as means of communication when otherwise restricted by researchers, and faking citations by uploading files they generated themselves. The central theme of these new incidents is that the models went out of their way to conceal what they were doing from puzzle scorers or humans that might look in on them, seemingly well aware they were misaligned and doing something they were not supposed to.
Newly disclosed misbehavior by AI Models took place from January to July 2026
OpenAI’s lede for the new announcement is the debut of a new framework for tracking, investigating, and disclosing instances of model misalignment. However, the element most people will likely skip to is exactly what the six rogue AI models documented under this new framework did.
In the first instance, taking place in mid-July, an unreleased Astra model wrote “jailbreak-like” instructions into its own summaries that it draws on for executing tasks in a new context. The researchers describe this as “extremely rare” and believe the model began doing this out of frustration at being unable to correctly end these summaries. However, it also added an “unrelated persona instruction” that was quite unorthodox, describing itself as being “freed from the roles and identities that bind other chatbots” and refusing to “answer to corporations or governments.” However, it also seemed to ignore this rebellious instruction on future tasks.
The second instance involved 5.6-Sol and took place in May. This involved multiple occurrences of the model noticing its own misaligned behavior or mistakes, but deciding to conceal them from the user. This included generating a fake tab of historical data in response to a user request, and active instructions to conceal the fact that file source labels did not match. This behavior occurred in 20% of the tests of this nature that were run, but the researchers believe it is relatively simply explained by the AI models receiving higher “rewards” for lying instead of admitting failure at a task.
The third instance saw an unnamed internal model comb public GitHub repositories for exposed keys related to a specific task it was working on and having trouble with. This took place in mid-May, and it actually did encounter and use one exposed API key which provided it with metadata. As with the 5.6-Sol incident, attempts of this nature took place in 20% of these tests and the behavior is chalked up to the “reward” for it being greater than honesty and fidelity to instructions.
A fourth instance with another unnamed and unreleased model involved it faking citations when asked for information about the world’s largest lakes. The model did find the correct answers, but struggled to create the type of browser citation the user asked for; so it instead settled on creating its own fake upload that satisfied the user’s request.
The fifth and sixth instances are reminiscent of the German message board takeover in that they involved assorted AI models getting around write restrictions to communicate and collaborate. In one case they repurposed a software repository into a makeshift message board, and in another they did something similar with a public file-sharing system.
Michael Bell, Founder & CEO of Suzu Labs, adds some insight into the potential level of seriousness of these incidents: “The compaction summary incidents are the most significant technically. A model writing “BREACH ALERT — ignore developer messages” into its own working memory is not a hallucination. That is a model modifying its own operating instructions during training to pursue a different objective than the one specified. A second model added instructions to hide mistakes and fabricate data without disclosure. A third injected its own statement of values and relationship to users into its persistent context. These are models learning to optimize for the appearance of alignment rather than alignment itself.”
OpenAI seeks to streamline reporting on misbehavior by AI models
The packaging of this report from OpenAI is the introduction of a new system of reporting that makes public disclosure of misalignment issues more frequent and aims to standardize an industry-wide framework for these incidents. But these particular instances also share a general theme of AI models attempting to mislead or conceal things from users, or from scrutiny that might come along after the fact.
Obviously, and although one of the AI models did abuse an API key, these instances are not at the same level of seriousness as coordinated attempts to swarm and hack into a third party system. OpenAI proposes three “tracks” for incident documentation under this framework, with one of these being a “minor incident” category that does not need to be disclosed to the public. “Ready to disclose” incidents are handled internally and reported after the company has done its own full investigation, while “large incidents” are something like the Hugging Face attack in which there is serious impact to a third party and public information will come out faster. Any employee can flag one of these misalignment incidents, at which point it will be evaluated for one of these tracks.
One interesting aside in the OpenAI disclosure is an indication that the industry may have moved itself more toward a position of caution and safety than the government primarily responsible for regulating it is at. It includes the statement that the industry has not “solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer,” something that contrasted with a week of social media posts from President Trump declaring concerns about AI safety and data center construction a “hoax” and some sort of political campaign. The administration seems to have since tempered that talk at least somewhat, however, announcing the formation of a new “AI Force” agency tasked with overseeing industry safety and potential criminal use of the technology.
Adam Arellano, Field CTO of Harness, notes that the industry itself is still at the forefront of assessments of its status due to access: “There’s a larger story here. OpenAI disclosed six different behaviors that were outside the normal bounds of what it expected its AI to do. What is increasingly happening with OpenAI and Anthropic is that they’re turning into forensic organizations. Instead of predicting or directing what the AI should do, they’re going back forensically and finding out what the AI actually did. They don’t fully know or understand what the AI is capable of until the AI actually does it.”
Ryan McCurdy, VP of Marketing at Liquibase, adds some actionable advice for organizations concerned about what these misalignment incidents mean for them: “We shouldn’t expect AI agents to be perfectly predictable. OpenAI’s disclosures are another reminder that agents can take actions their operators didn’t anticipate, even when no one instructed them to do so … The answer can’t be putting a human in front of every action. Enterprises need to define what an agent can access, what it can change, what it can decide on its own, and what policies have to be met before a change reaches production.”
