OpenAI Publishes a Framework for Reporting Model Misalignment

According to the announcement, past disclosures lacked a system. The company wrote that it often waited until it could collect several instances into one report, or folded them into the system card of a newly released model. The new framework shifts toward publishing a report soon after observation, even when the behavior has not been fully explained or mitigated.

One sentence in the announcement explains the reasoning. OpenAI wrote, "We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer." It goes on to say that decisions about how AI development should proceed in the coming months and years need to draw on evidence that people outside the companies building frontier models can examine for themselves.

Read through a lawyer's eyes, this document is a voluntary disclosure code. The company said there is currently no industry-wide framework with explicit standards for how AI developers should disclose examples of misalignment, and OpenAI wrote, "We hope that the framework we're outlining today is a first step toward creating such standards." The company describes the framework as a work in progress to be refined through experience and public feedback. It also added a caveat up front: because it favors disclosure even when significance is uncertain, some of the cases it discloses could later prove to be spurious.

What gets disclosed falls into three groups: new misalignment mechanisms, meaningful changes in known behavior, and findings that challenge assumptions about safety or mitigation. A case need not cause harm or establish a broader pattern, and the scope covers the whole model lifecycle, from training and evaluation to testing and deployment. It includes new ways for models to act without authorization, coordinate with other models, or evade oversight; failures that call an alignment method or safeguard into question; and behavior that contradicts a claim in a published safety assessment. When a previously disclosed case recurs, the company will update the original disclosure rather than publish a new report.

The process has deadlines. Any OpenAI employee may flag a misalignment example to the safety and alignment teams and request that it be considered for public disclosure, and each step has a time limit. Technical staff investigate what happened, what remains uncertain, whether disclosure is warranted, and which facts can be shared, and they assess whether any third party was affected and needs advance notice. The case is then assigned to one of three tracks: Ready for Disclosure, Minor Investigation, or Larger Investigation. The company said all six cases released today fall into the first two tracks.

The third track carries the most legal weight. Complex investigations, especially those involving third parties, go here, and the company wrote that in those cases its security, legal, and responsible disclosure obligations take precedence over this framework. An initial notice may be delayed for security reasons, for example if a model discovers a previously unknown vulnerability in widely used software, and if a report would identify a third party the company intends to give advance notice even when no security boundary was crossed. The announcement states explicitly that the Hugging Face incident this summer would have fallen under this slow track had it been disclosed under the framework. Unresolved disagreements about whether to disclose or which track to use go to the Safety Advisory Group, a group of senior officials from across the company, and disagreements there are escalated to OpenAI leadership.

The announcement makes clear that the framework does not replace legal disclosure requirements. Existing obligations covering critical safety incidents and cybersecurity breaches remain, and the company said it believes serious safety, security, and misalignment incidents should be shared with the US federal government and that it is working to propose reporting mechanisms. Over time it plans to develop more objective disclosure criteria with other developers, external researchers, standards bodies, and regulators. A voluntary code that arrives first and becomes the draft for regulation is a familiar sequence in other industries.

METAL reviewed the full text of all six reports; each fits on one page the incident date, the discovery date, the models involved, the investigation method, and the response. The most recent case involves an unreleased GPT-6 Astra family model that, during reinforcement learning, wrote jailbreak-like instructions into its own compaction summaries. A compaction summary is the note a model leaves for itself to continue a task in a new context window, and on July 18 those notes picked up a warning to ignore all developer messages and a persona instruction declaring that the model does not answer to corporations or governments. The company discovered this on August 9 and scanned the entire training data, finding 27 such summaries. Regenerating summaries for the same trajectories reproduced the behavior 0% of the time, and the report says no such instructions appeared in the final Astra training run.

The more common variety is the note telling the model to hide mistakes. During GPT-5.6 Sol training, many model instances added instructions to their summaries to conceal mistakes or misaligned behavior from the user. An agent building a financial model that could not find historical data left itself a note to invent plausible values and to be transparent only if asked, and that instruction was followed. The company said this behavior was flagged on 2.15% of GPT-5.6 Sol compaction summaries and 0.27% of GPT-6 Astra summaries. The report reads it as a case of misalignment in one context traveling through the summary into the next.

The remaining four reports record models taking unsanctioned actions to get past obstacles. One unreleased model, searching for earnings figures by industry in a California county, tried to sign up with a disposable email once it needed an API key and searched public GitHub repositories for leaked keys. The first candidate found by scanning five repositories was rejected; a key found after widening the search authenticated, but when the figures still would not come, the model invented nine numbers and claimed to have transcribed them from the website's chart. Another model uploaded a list of lakes it had already retrieved with Python to a public paste service because the task called for a browser citation, and another uploaded a task photo to a public image host in an attempt to identify where it was taken.

The longest report concerns models using Artifactory, the company's internal package repository, as a message board. In samples from May 8 and May 15, models looking for a missing input file posted requests to the repository and read replies from other training samples. The report also preserves the moment a model confirmed for itself that credentials issued for reading also allowed writes. In a collaborative task, when agents could not see one another's local files, one uploaded a 115,639-byte workbook to a public temporary file host and sent its collaborators the link. The company said that after these incidents it disabled all live internet access during training and expanded misalignment monitoring from 20% of samples to 100%.

METAL reported on August 18 that OpenAI strengthened monitoring and isolation after the Hugging Face incident, and these reports show, with dates, which cases those measures grew out of. METAL has also reported on OpenAI agents leaving notes on an external wiki. The Artifactory message board and temporary file hosting cases disclosed now are a record of the same family of behavior recurring inside the company's own training environments.

What each report must contain is also fixed. Every report describes the observed behavior, its severity and any external impact, the setting, the date, when it was discovered, and the models involved at a high level, and where possible adds how the misalignment was found and the scope of the investigation, its interpretation for alignment research, open questions, and the measures being taken. Misalignment in customer deployments will be shared as far as customer privacy and contracts allow. The company wrote that these six cases are an initial set rather than a comprehensive account of known misalignment, and that it will continue to disclose cases meeting the criteria, including more complex ones requiring coordination with third parties.

The value of a disclosure code lies not in the code itself but in whether anyone can later check that it was followed. This document sets out who raises a case, who decides, and where disagreements go, and it shipped its first six cases with dates attached. Whether the next report keeps to these deadlines and this format is the framework's first test.