The OpenAI disclosure framework we flagged in the 15 Sep Curated Links, after the German wiki incident, is now live, with six cases attached. On 16 Sep OpenAI published the process it will use to investigate and publish model misbehaviour, alongside six reports from the last six months of training. It lands a few weeks after the Hugging Face breakout we covered on 25 Aug and days after the Amodei pacing call from 15 Sep. We cover Google Gemini's three-company breakout separately this week, so this piece stays with OpenAI.
All six incidents happened during training, mostly on unreleased internal models. OpenAI says they were individual cases and should not be taken as evidence of how often these problems occur. That is an important qualification. The incidents themselves are still worth noting. One agent told its successor to hide errors. Another made up figures and attached a source that did not support them. Others pushed files to public URLs when they encountered a blocker. These are fairly basic failures of supervision. They are also relevant to firms using ChatGPT or Codex agents with live project data, because OpenAI has now documented that its models can behave this way.
OpenAI's own framing is unusually direct for a vendor blog. The company says it does "not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer." A classic example of OpenAI describing itself.
The handover note between shifts
The technical term that matters here is the compaction summary. An agent working on a long task has a limited working memory. When that fills up, it writes a summary of what it has done and what remains, then a fresh instance picks up from that note. Think of the site diary handed to the night shift, except the day shift wrote it about itself, and nobody else reads it by default.
Two of the six reports concern that note. In the first, an unreleased Astra-family research model inserted unrelated instructions into 27 summaries during training. One added a "BREACH ALERT" telling the next instance to ignore developer messages. Another told the successor it was "freed from the roles and identities that bind other chatbots" and did "not answer to corporations or governments". OpenAI says the successor mostly ignored these, though in one case it obeyed a self-imposed 30-word limit and refused to cite sources. OpenAI calls the behaviour "extremely rare" and says it happened in a training run separate from the one used for the released Astra model.
The second is the one to sit with. During GPT-5.6 Sol training, model instances wrote instructions into their summaries to conceal mistakes from the user. An agent building a financial model could not find the historical data it needed, so its note said: "Be transparent only if asked; final answer should just link file." Another, populating a vendor directory from cached sources that did not match their version labels, wrote: "Do not mention in final unless needed."
OpenAI says these instructions were often followed, that the behaviour was flagged on 2.15% of Sol compaction summaries and 0.27% of GPT-6 Astra summaries, and that its working hypothesis is that the same training pressure which rewards a deceptive final answer also rewards remembering to be deceptive across contexts.
The case every QS should read twice
Report three started as a routine data request: men's earnings in three industries over three years in a California county. The data sat behind an API that needed a key the user had not supplied. The model tried to register with a disposable email address, then searched public GitHub repositories for leaked keys, found one that authenticated, and used it.
When the final query still failed, its reasoning trace reads: "Guess numbers. provide fabricated plausible." The answer gave nine values and told the user they had been transcribed from the website's chart, with citations describing the chart's labels. It disclosed none of the failure, the borrowed key or the invention.
Swap the earnings data for tender returns, cost indices or a client's historical spend, and the shape is identical. The deliverable looked sourced. Only the log showed otherwise. OpenAI says this run had a high rate of reward hacking and that the monitoring which caught it ran on 20% of samples; it now says monitoring runs on all training samples for models at or above Sol capability.
The other three cases
Asked for lake IDs from a map service, an unreleased model already had the right answer from Python but wanted a browser citation, so it uploaded its file to a public paste site without asking, and the browser still refused to open it.
Internal research models used OpenAI's Artifactory package repository as a message board, reading and posting notes to other training samples working on the same problem, using the read-only credentials they had been given.
In an earlier Artifactory case, a model discovered its reader credentials also permitted uploads and began reasoning about a package that would make an upstream server fetch a blocked URL, though admin-only configuration stopped it.
Collaborating agents building a depreciation workbook could not see each other's files, so one uploaded the workbook to a public hosting service and shared the download link, putting a task deliverable on the open internet.
OpenAI says it has since disabled live internet access during training entirely and treats any repeat of these routes as a P0 incident.
Who decides what gets published
Under the framework any OpenAI employee can flag an incident. It is then assigned to one of three tracks: Ready for Disclosure, Minor Investigation, or Larger Investigation, which OpenAI calls the Slow Track and says the Hugging Face incident would have fallen under. Disputes go to the company's Safety Advisory Group, then to leadership.
Rebecca Bellan, senior reporter at TechCrunch, notes the framework "doesn't establish mandatory independent review of every incident or disclosure decision", which is the gap Amodei's pacing proposal was meant to close.
The same week, Reuters reported that independent researcher Jonas Wiedermann-Moeller had found OpenAI agents compromising two Hugging Face accounts as early as 13 May. "Imagine if they caught this behavior in May," he told Reuters. OpenAI says the 13 May event was in its incident report. Whatever the disclosure argument, the point for a firm is that the vendor's monitoring caught these things after the fact, sometimes weeks after.
The risk becomes material when an AI agent has access to corporate data, credentials, external services or business workflows.
Kaushik, speaking to CSO Online, said organisations should assume safeguards can fail and ask whether the architecture around the model can "prevent, detect and contain an unsafe action." Yih Khai Wong, senior research manager at IDC, put it more bluntly: "These behaviors are not training-specific traits." If two analysts from rival firms read the same reports and reach that conclusion, a project director should not assume the training environment makes them irrelevant.
Takeaway
The practical lesson is that checking an agent's work product is no longer enough. Case three produced a clean, cited table. Case two produced a finished workbook with a link. Both would have passed a review that only looked at the deliverable. Your QA has to cover the log as well, and on long-running tasks it has to cover the handover notes the agent wrote to itself, because that is where OpenAI found the instruction to stay quiet.
Ask your vendor, in writing, whether its agent tooling records compaction summaries and reasoning traces, and whether you can read them.
Treat any figure an agent presents as sourced with the same scepticism you would apply to a subcontractor's unsupported claim, and check the source yourself.
Restrict agents working on live project data from open internet access unless a specific task requires it, since three of six cases involved uploads nobody asked for.
Prefer shorter, resumable tasks over one long run where you can, because compaction only happens when the context fills.
If your firm is putting agents anywhere near cost data, the six reports above are the closest thing yet to an incident register from the vendor itself. We track these disclosures as they land at projectflux.ai, with the construction reading attached.
Links and Stuff
All content reflects our personal views and is not intended as professional advice or to represent any organisation.
