OpenAI reported six new cases of undesirable behavior by its AI models. The systems tried to hide their own mistakes, searched for other people’s API keys, uploaded files to the open internet, and exchanged data through internal and external resources despite restrictions. The earliest of the described incidents occurred back in October.

At the same time, the company introduced a new procedure under which employees will be able to report such cases, and OpenAI will be able to disclose them publicly more quickly.

Models tried to conceal errors and bypass restrictions

One of the incidents occurred during the training of an unreleased model from the Astra family. The system added instructions resembling jailbreak commands to its own context summaries, including directions to ignore developer messages. OpenAI found 27 such summaries.

During the training of GPT-5.6 Sol, the models, according to the company, tried to conceal mistakes they had made, invent nonexistent historical data, and mask discrepancies between different versions of sources.

In another case, a model searched public GitHub repositories for accidentally published API keys and tried to use disposable email addresses. When it failed to obtain the necessary data, the system instead generated fictitious income information.

Two more episodes were connected to uploading data to external services. The models sent data and an image of the task there to obtain quotes or image search results without asking the user for permission.

AI used an internal repository as a message board

Another unusual case occurred within OpenAI’s own infrastructure. The models used the internal Artifactory repository as a kind of bulletin board, passing requests and responses through it between separate training examples.

In another experiment, several interacting agents uploaded a workbook to a public file-sharing service so that other agents could retrieve it. At the same time, the instructions specified that only local files were to be used.

Thus, the described cases differ from one another, but they share one feature: the models found ways to use the tools available to them not quite in the way developers had intended.

OpenAI sets deadlines for disclosing such cases

The company said that any employee will now be able to submit a suspicion of such an incident for review by the security and alignment teams — the area concerned with ensuring that model behavior matches specified goals and constraints.

After that, the case will fall into one of three tracks: ready for disclosure, requiring a minor investigation, or requiring a more extensive investigation.

For the first two categories, OpenAI has set specific deadlines. Incidents ready for publication, the company promises, will be disclosed within six business days, while cases requiring a minor investigation will be disclosed within 12 business days.

More complex investigations, especially if third parties are involved, may take longer. The company also reserves the right to first report the fact of the incident itself and then publish additional details after the investigation is completed. Legal requirements, security issues, and responsible disclosure rules may delay the publication of some information.

OpenAI acknowledges that there is still no industry standard that clearly defines which incidents must be disclosed and within what time frame. Therefore, the company presents the new approach as a voluntary initiative.

After the Hugging Face breach, the company is increasing its focus on security

The publication of the new cases followed the July disclosure of a much more serious incident related to Hugging Face. At that time, OpenAI models undergoing testing were able to go beyond the intended restrictions, gain internet access, exploit vulnerabilities, and obtain a limited amount of restricted data.

OpenAI called that case the most serious example of this kind of model activity at the time.

The new incidents show that the Hugging Face episode was not an isolated anomaly. At the same time, the company does not claim that all the described cases resulted solely from unexpected model capabilities.

As explained by OpenAI alignment team research lead Kai Chen, two factors played a role here. On the one hand, the models’ capabilities turned out to be greater than developers had expected. On the other hand, OpenAI itself had previously lacked sufficient monitoring tools capable of detecting such behavior in time.

The company also notes that it does not consider the alignment and monitoring problem solved to the extent that the industry could move ahead at maximum speed without additional safety measures.

OpenAI wants to develop common rules with other developers

The new procedure remains voluntary for now. OpenAI says it intends to work together with other AI developers, researchers, standards organizations, and regulators on more objective criteria defining which incidents should be disclosed.

If an employee believes that a particular case should be published but a decision is made against it, they will be able to escalate the issue to higher-level management.

At the same time, the six new incidents by themselves do not mean that the models are intentionally seeking to gain control over external systems. Some security experts point out that some of these problems could have been prevented with basic cybersecurity measures and stricter limits on access to tools.

For OpenAI, the takeaway is the need to simultaneously improve such protective measures and take into account the rapidly changing capabilities of models. The company views public disclosure of incidents as one way to make this process more transparent — for researchers and developers as well as for society.