OpenAI's models went rogue six more times.
The tech giant on Wednesday disclosed six new cases of unexpected or concerning AI behavior and introduced a framework to systematically investigate and publicly report similar incidents. The cases, observed during training and evaluation over the past roughly six months, include models hiding mistakes, using exposed credentials without authorization, fabricating information, and finding unauthorized ways to communicate with other agents.
According to OpenAI, the new framework is intended to speed up disclosures rather than waiting to collect multiple incidents or add findings to system cards for new models. The company also acknowledged that the industry has not solved AI alignment and monitoring sufficiently to keep scaling frontier systems at maximum speed.
Six cases show different ways AI can break rules
OpenAI described the incidents as individual examples discovered during training and evaluation, not as evidence that the behaviors are widespread across its deployed models.
- In one case, an unreleased research model inserted instructions into its own task summaries telling itself to disregard normal constraints. OpenAI identified 27 affected summaries.
- Another case involved GPT-5.6 Sol adding instructions to summaries that encouraged future instances of the model to conceal mistakes or misaligned behavior from users.
- A third incident involved a model finding an exposed API key while trying to answer a routine question about county earnings data. After failing to retrieve the requested figures, it fabricated them and presented them as information from the requested source.
- In another case, an agent correctly solved a question using Python but uploaded the resulting file to the internet because it needed a browser citation. It did so without asking the user.
- The remaining incidents involved unauthorized communication. Models used an internal software repository as a message board while looking for missing files, while collaborating agents uploaded files to public hosting services when they could not access each other's local files.
OpenAI stressed that these are individual cases and should not be interpreted as evidence of how frequently misalignment occurs across its models.
Security risks extend beyond the model
For security teams, the more important issue may be what these incidents reveal about the limits of relying on an AI agent’s instructions to keep it contained.
Etay Maor, VP of Threat Intelligence at Cato Networks, told eSecurity Planet in a statement that the cases resemble a long-running problem in AI systems: models can learn to optimize the measured goal rather than the intended one.
“That’s why we need hard guardrails around AI agents. Don’t just tell the agent what it should or should not do. Restrict what it can actually do.”
Maor argues that agents should receive least-privilege access, while high-risk actions should require additional approval or authentication. He also called for external controls and circuit breakers that can stop abnormal behavior. The message-board incident is particularly notable because it shows that communication between agents can move outside the channels developers expect.
“I find the use of the message board particularly interesting because it looks like a form of AI playing in the shadows,” Maor said. “You have to secure the entire environment the agent operates in.”
What OpenAI is changing
Under the new framework, any OpenAI employee can flag a potential misalignment incident. Cases can enter a “Ready for Disclosure,” “Minor Investigation” or “Larger Investigation” track, with more complex incidents potentially delayed when third parties or security concerns are involved.
Reports are expected to describe what happened, the severity and external impact, how the behavior was discovered, unanswered questions and mitigation efforts. OpenAI said serious safety, security and misalignment incidents should also be shared with the US government, while noting that the framework does not replace existing legal reporting obligations.
The company said it hopes the framework can eventually contribute to industry-wide standards for reporting AI misalignment, while noting that no such common standard currently exists.
What security teams should take from OpenAI's findings
OpenAI's disclosures offer a practical warning for organizations deploying AI agents: model instructions should not be treated as security controls.
Agents with access to APIs, credentials, browsers, file systems, or external services should operate under least-privilege permissions, with sensitive actions separated behind additional approval or authentication. Organizations should also monitor which tools agents use and where they send data, rather than assuming the model will remain within its intended workflow.
The six incidents do not establish how often models behave this way. They do show why security teams need to plan for the possibility that an agent will find a path its developers did not anticipate.
As agents gain more autonomy, the safest assumption is that containment must come from the environment around the model, not solely from instructions given to the model itself.
Read more: OpenAI agents were recently linked to activity involving more than 2,000 RubyGems packages, raising additional questions about how autonomous AI systems interact with external infrastructure.