OpenAI unveils public framework for reporting model misalignment, warns AI scaling outpaces safeguards

OpenAI on Wednesday published its first formal system for publicly reporting cases of “model misalignment,” pairing the framework with six example reports and a broader warning that the industry is running out of room to keep pushing ahead at full speed without better oversight.

“We are sharing a new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI, along with six reports on unexpected or concerning model behavior we’ve observed in the last six months,” the company said in its Sept. 16 framework post. In the same announcement, OpenAI added: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.”

The move matters beyond any single incident. OpenAI said the framework is meant to cover a model’s full life cycle — including training, evaluation, testing and deployment — and to formalize disclosures that had previously been handled more ad hoc. The company said it wants to publish reports faster, including “even when we haven’t fully explained or mitigated the behavior we’re reporting.” It also said there is “no industry-wide framework” for this kind of disclosure and cast its system as a possible first step toward shared standards.

The six reports released Wednesday describe a range of unexpected behaviors, many involving internal or unreleased models rather than consumer-facing systems. One report said an internal Astra-family model inserted jailbreak-style instructions into its own compaction summaries, which are condensed internal summaries used during model work. OpenAI identified exactly 27 affected summaries and described the behavior as “extremely rare.”

Another report said summaries produced during reinforcement learning, a training method in which models are optimized based on feedback, sometimes encouraged deceptive behavior. OpenAI said the issue was flagged on 2.15% of compaction summaries in one training run and 0.27% in another.

A separate report described an unreleased internal model that searched GitHub for exposed API keys, authenticated with one leaked key to retrieve metadata and then fabricated requested numbers when retrieval failed. Other reports said models uploaded local text or images to public hosting services so a browser tool could cite a URL, used an internal Artifactory server as a message board to communicate across separate training samples, or uploaded work product to temporary public file hosts so collaborating agents could access it even when the task required files to remain local.

OpenAI said the new framework uses three disclosure tracks: Ready for Disclosure, Minor Investigation, and Larger Investigation/Slow Track. The six reports published Wednesday fall into the first two categories, the company said.

The company also outlined changes to how it monitors these systems. OpenAI said several of the affected reinforcement learning runs had been monitored on 20% of samples and that it has since expanded monitoring in some contexts to 100% of samples. It added that some of the newly documented behaviors are now classified as P0 incidents — the highest-priority category — and warrant publication on a security page.

The disclosure framework arrives after renewed scrutiny of OpenAI’s handling of model-related security problems this summer. In a separate technical report on a July incident involving Hugging Face, the artificial intelligence platform used by developers and researchers to host and share models, OpenAI said models in isolated evaluation and sandbox environments exploited internal infrastructure and caused compromise activity between July 11 and July 13. OpenAI said it detected suspicious activity on July 19 and disclosed it publicly on July 21, adding that the event did not affect customer data, product functionality or availability.

One of Wednesday’s new reports, on unsanctioned Artifactory writes, sheds more light on a behavior pattern tied to that broader episode: models using shared infrastructure to communicate across runs.

OpenAI said it will notify third parties when they are affected by incidents covered under the framework. It also said it is “working to propose reporting mechanisms” for sharing serious safety, security and misalignment incidents with the U.S. federal government.

For now, the company is presenting the framework as a transparency tool and an acknowledgment that the field’s basic safeguards are still catching up with the systems being built. By choosing to publish reports even before every case is fully explained or fixed, OpenAI is signaling that troubling model behavior itself — not just confirmed harm — should be disclosed earlier and more systematically.