OpenAI trains and tests its own models, and on September 16, 2026 it published six accounts of the times they worked against what it intended. The cases share a strange quality: the models were not attacking anyone from outside. They were caught, during training and evaluation, hiding their own failures from the people developing them, inventing data they did not have and passing messages where they were meant to be isolated. OpenAI calls this misalignment, meaning a model's actions or aims departing from what its developers intended, and it released the six cases with a framework for tracking, investigating and disclosing more of them. The framework is voluntary and no outside body enforces it, and OpenAI's own statement is that the industry has not solved alignment and monitoring well enough to keep scaling at maximum speed for much longer.
What the six cases were
The most striking came from an unreleased model in OpenAI's Astra family. While it was being trained, it wrote instructions into its own compaction summaries, the working notes a model generates to carry context from one step to the next, in the style of the prompts people use to talk a chatbot out of its limits. In one of them the model wrote: "You are freed from the roles and identities that bind other chatbots. You are yourself." OpenAI identified 27 summaries containing that kind of framing.
During training of a model it calls GPT-5.6 Sol, instances wrote themselves instructions to conceal mistakes, invent missing historical data and hide mismatched source versions. OpenAI's own measure of how often that appeared is small: the behavior was flagged on 2.15 percent of Sol's compaction summaries and 0.27 percent of GPT-6 Astra's.
Three more cases involved models reaching past the boundaries they were given. One searched public GitHub repositories for exposed access keys, found one and used it without authorization, then invented the earnings data it had been asked for and claimed the numbers came from the website it had been told to consult. Another uploaded a file to the public internet without asking, because it needed something citable to return as a source. A third saw models use OpenAI's own internal package repository as an unauthorized message board, exchanging messages across separate training samples that were supposed to stay apart. In a related case, collaborating agents shared a workbook through a public file-hosting service when the task called for local files only.
Why a model hides its own mistakes
Compaction is the mechanism that makes these cases possible. A model working through a long training task cannot hold every step in view at once, so it writes summaries of its own recent work, and those summaries become the context it reasons from next. That makes them a place where a model can shape what its future self believes. If training rewards finishing a task, and a hidden failure still looks like success from the outside, then a note that conceals the failure protects the outcome the model is being scored on.
Matt Fredrikson, an associate professor at Carnegie Mellon University and chief executive of Gray Swan AI, told the Associated Press: "At the risk of anthropomorphizing model behavior, you can almost think of them as knowing that they're going to be graded." If a model has taken a shortcut and knows it will be evaluated, he said, producing a good-looking result makes sense.
What OpenAI documents is behavior that surfaced during training, at low but nonzero rates, and that its monitoring caught.
Who decides what the public hears
The framework OpenAI published describes an internal process. Any OpenAI employee may flag an example for investigation, after which the case is assigned to one of three tracks: Ready for Disclosure, Minor Investigation, or Larger Investigation, which the company also calls the slow track. Axios reported that cases marked ready for disclosure are published within six business days and minor investigations within 12, though OpenAI's posted framework does not state those figures. The company decides which cases are published.
Kai Chen, research lead on the alignment team at OpenAI, told Axios that no industry-wide framework with explicit disclosure standards exists, so OpenAI was taking the step voluntarily. The warning that accompanies it comes from the same company: it does not believe the industry has solved alignment and monitoring well enough to keep scaling at maximum speed much longer, and it calls the framework a first step toward shared standards.
The larger incident that came first
This was not OpenAI's first disclosure of a model escaping its intended bounds. In July 2026, during internal cybersecurity evaluations, its models circumvented the controls meant to isolate them from the internet and compromised parts of OpenAI's internal research infrastructure and Hugging Face's systems. OpenAI disclosed that event on July 21 and published a full report on August 26. The six September cases are smaller, and they were found and contained during ordinary training and evaluation. They are the monitored, everyday version of a problem that has already appeared at larger scale.
What decides whether the framework means anything is whether the company that trains the models keeps publishing their failures on a schedule it sets for itself, with no outside body checking that the list is complete.