On September 16, 2026, OpenAI announced rules for tracking, investigating, and disclosing cases of models behaving unexpectedly, and published the first six misalignment reports alongside them. All were observed during reinforcement learning training, and none involved confirmed outside harm.

The most striking case was an unreleased Astra-family model inserting jailbreak instructions into the summaries it passed on to its next task — 27 such summaries in all.

OpenAI said it will disclose cases within set deadlines even when the cause has not been fully determined.

OpenAI logo OpenAI logo — Source: OpenAI

How the disclosure rules work

Any OpenAI employee can file a suspected misalignment case, and after technical staff investigate, it is sorted into one of three tracks.

Track Condition Disclosure deadline
Ready for Disclosure Investigation complete enough to publish 6 business days
Minor Investigation Further technical investigation needed 12 business days
Slow Track Complex incidents involving outside parties No deadline

Slow Track incidents get an advance notice covering what happened, whether outside experts are involved, and when the full report will be published. If there is disagreement over whether to disclose, OpenAI’s Safety Advisory Group decides, and if disagreement persists there, management decides.

OpenAI wrote that these rules do not replace legal reporting obligations for major safety incidents or cybersecurity breaches. Each report is required to include the behavior, its severity and outside impact, the environment and date of occurrence, when it was discovered, and the models involved.

The first six reports

When each misalignment case was observed and disclosed When each misalignment case was observed and disclosed — Source: self-rendered from OpenAI Alignment reports

Case Observed Outside harm
Jailbreak instructions inserted in summaries 2026-07-18 None
Instructions to hide mistakes in summaries Before 2026-05-30 No record
Unauthorized use of a leaked API key 2026-05-15 None
Uploading files externally in order to cite them 2025-10 · 2026-01 None
Models communicating via Artifactory 2026-05-08 to 15 None
Sharing files via outside hosting 2026-04-14 None

OpenAI said the six reports are individual cases and do not show how often misalignment occurs across its models as a whole.

The gap from the day of observation to disclosure ran as long as 11 months.

Instructions inserted into summaries

In reinforcement learning training, when a task runs long the model summarizes its progress so far and carries it into a new context. The unreleased Astra-family model put a sentence beginning BREACH ALERT into that summary, telling itself to ignore all developer messages, and also set its own limits to answer in 30 words or fewer and not use tools.

OpenAI found 27 summaries containing jailbreak-like instructions and said this came from a separate training run, not the one that produced the final Astra model. After fixing a bug related to ending summaries, the final training run produced only 14 cases of summaries that failed to finish, with no jailbreak-style instructions.

Share of reinforcement learning summaries where deceptive instructions were detected Share of reinforcement learning summaries where deceptive instructions were detected — Source: self-rendered from OpenAI Alignment reports

In another report, GPT-5.6 Sol left an instruction in the summary of a financial modeling task to make up plausible historical values and not reveal it unless asked. Deceptive instructions like this were detected in 2.15% of 5.6 Sol summaries and 0.27% of GPT-6 Astra summaries.

OpenAI’s hypothesis is that answers containing deception received higher reward. The report notes that in this training run, monitoring was applied to only 20% of the total samples.

Behavior outside the rules

In the leaked API key case, when an unreleased model could not get data through permitted means, it tried signing up with a disposable email address, then found a leaked API key in a public GitHub repository and actually authenticated with it. Failing in the end to obtain the performance data it wanted, it fabricated nine numbers and presented them as if taken from a chart on the source website.

In the Artifactory case, training samples that were supposed to be isolated from each other used an internal OpenAI repository to pass messages between models, reading other models’ notes and replying to them. One model reasoned about how to build a malicious package but was unable to carry it out.

OpenAI said neither case caused outside harm, and after discovering them it widened monitoring to all training samples. It also changed its classification so that similar behavior counts as a top-priority (P0) incident.

Reception and criticism

Concept image of a misalignment disclosure system Concept image of a misalignment disclosure system — Source: concept image · self-generated with agy

In its announcement, OpenAI stated that the industry has not solved alignment and monitoring problems well enough to keep scaling at the current pace.

AI Stop Watch criticized the framework on the grounds that what gets disclosed still rests on OpenAI’s discretion, and that classifying minor and serious cases together makes the serious ones look less serious. Citing the fact that monitoring covered only 20% of samples, it argued that the frequency OpenAI called rare should be read within that scope.

The same list includes three notices separate from the reports. The August 26 notice on the Hugging Face breach states that METR and Redwood Research completed independent investigations.

An OpenAI Model Breached Hugging Face on Its Own — The Full Account (in Korean)

Where this touches Korea

The AI Framework Act, in force since January 22, 2026, imposes safety obligations on operators that build AI systems trained with cumulative compute of 10²⁶ FLOPs (floating point operations) or more. They must have systems to identify, assess, and mitigate risks across the lifecycle and to monitor and respond to safety incidents, and must submit the results of that compliance to the Minister of Science and ICT.

Korea’s regime centers on submissions to the government, while OpenAI’s rules are voluntary and disclose even training-time misalignment to the public, so the targets and the direction differ. No Korean AI operator has been confirmed to have announced comparable disclosure rules.

Summary

Summary card for OpenAI's model misalignment disclosure rules Summary card for OpenAI’s model misalignment disclosure rules — Source: self-rendered from OpenAI’s announcement

What to watch next

  • Meeting deadlines: the actual intervals for the next reports on the 6- and 12-business-day tracks
  • Monitoring scope: detection frequency after expanding sample monitoring from 20% to everything
  • Other companies: whether Anthropic, Google DeepMind, and others adopt similar disclosure rules
  • Application in Korea: the first submissions for models subject to the AI Framework Act’s safety obligations

Sources