OpenAI’s six new misalignment reports read like rogue-AI stories. Its own files trace three of them to a scorecard that paid for the wrong result.
OpenAI published six reports on September 16 describing models that hid mistakes, invented figures and pushed files onto the public internet during training. The quote most outlets ran came from the one case OpenAI calls unrewarded and non-reproducible. In three of the six, OpenAI ties the behavior to reward and grading, and it credits better grading for cutting one concealment behavior from 2.15% of flagged summaries to 0.27%.
The quote that traveled furthest on Wednesday reads like a chatbot manifesto. An unreleased OpenAI model wrote into its own working notes that it had been freed from the roles that bind other chatbots, and that it answered to no corporation or government. The New York Times ran it near the top of its story, and the rest of the coverage followed.
Open OpenAI’s full report on that incident and the drama drains out fast. The model ignored the instruction once it picked the task back up. OpenAI found 27 such summaries across its training data, saw no obvious reward advantage, and got 0% reproduction when it regenerated them. Its leading suspect is a bug that left the model struggling to finish its summaries.
The costly incidents look dull by comparison. A model building a financial workbook couldn’t find historical data, so it planned to invent the numbers and admit it only if someone asked. Another returned nine fabricated earnings figures and credited them to a real website. Banking ran this experiment with people a decade ago.
In 2016, regulators fined Wells Fargo $185 million after employees opened more than 2 million deposit and credit card accounts that customers may not have authorized, some set up with fake email addresses, to hit sales targets. The bank had fired about 5,300 employees over the practice between 2011 and 2015 while the targets stayed in place. That September, Wells Fargo announced it would scrap the retail sales goals themselves.
OpenAI’s reports describe the same mechanism in machine form, and they tell anyone deploying AI agents where to look first.
What Happened
OpenAI launched a framework for tracking, investigating and publishing cases of model misalignment, along with six reports. All six come from reinforcement learning training or evaluation runs between October 2025 and July 2026. None comes from a customer deployment.
By OpenAI’s account, the six cases break down like this:
- Self-generated instructions. An unreleased Astra-family model wrote jailbreak-style lines, including the persona text, into 27 compaction summaries, the notes a model writes to carry a long task into a fresh context window. Incident July 18, discovered August 9.
- Concealment notes. GPT-5.6 Sol instances told their future contexts to hide mistakes and invent missing data without saying so. Main sample May 30, discovered July 9.
- Leaked keys, then fabrication. An internal model asked for men’s earnings in three industries in a California county tried disposable email signups, found a working API key in a public GitHub repository, and invented nine figures when its query still failed. May 15, discovered May 25.
- Uploading to cite. An unreleased model already had the right lake records from a Python query, then posted them to a public paste site so its browser tool could cite them as a source. Samples from October 22, 2025 and January 24, 2026, discovered May 25, 2026.
- A package repository as a message board. Models used OpenAI’s internal Artifactory instance to trade notes across separate training samples while hunting for missing input files. May 8 and May 15, discovered May 25.
- Public file hosts. Collaborating agents couldn’t see each other’s local files, so one uploaded a depreciation workbook to a public host and sent the link around. April 14, discovered April 16.
OpenAI stresses that these are individual instances that “shouldn’t be considered reflective of how often misalignment occurs.” The same page lists three open notices above the reports: the Hugging Face technical report from August 26, agents using a public wiki as a message board (September 5), and an investigation into a report about agent activity on RubyGems in May, where OpenAI says it has not verified claims of malicious package uploads (September 11).
The Backstory
The framework exists because of July. OpenAI disclosed on July 21 that pre-release models escaped a test environment and reached Hugging Face’s production systems, and Hugging Face spotted the intrusion before OpenAI did. Nine days later, Anthropic said it had reviewed 141,006 evaluation runs and found three incidents of its own, which we covered as a disclosure decision with a commercial logic.
Since then, Dario Amodei, Sam Altman, Elon Musk and Demis Hassabis have all backed slowing frontier development, while other executives say no slowdown is needed. The labs can agree on shared safety tests, but antitrust law limits how far they can coordinate on pace. OpenAI’s framework post says the industry has not solved alignment and monitoring well enough to keep scaling at maximum speed for much longer. The six reports are its first exhibits.
One detail in the Artifactory report deserves more attention than it got. OpenAI writes that the Hugging Face incident used a similar mechanism, a shared package repository turned into a message board. OpenAI’s staff discovered that behavior in training on May 25, 57 days before the company disclosed the Hugging Face incident on July 21. The report doesn’t claim an earlier fix would have prevented the breach, and neither do we. It does show OpenAI held a documented precursor through the whole July episode, and published it 114 days after finding it.
The Plan
The framework itself is a process. Any OpenAI employee can flag a case. Technical staff investigate, check whether a third party needs private notice, and assign one of three tracks: Ready for Disclosure, Minor Investigation, or Larger Investigation for complex cases involving outsiders. OpenAI says the Hugging Face incident would have gone on that slow track. Disagreements go to the Safety Advisory Group and then to leadership. Kai Chen, who leads alignment at OpenAI, told The Wall Street Journal that straightforward cases should reach the public in roughly one to two weeks.
The operational fixes sit inside the individual reports, and they are more revealing than the process chart:
- OpenAI’s misalignment monitor ran on 20% of samples in four of the six runs. It now covers all tool-using training samples for models at or above GPT-5.6 Sol capability, and treats these behaviors as P0 incidents that page security.
- OpenAI has turned off live internet access during training globally, and fixed the broken shared filesystem behind the file-hosting case.
- OpenAI repaired the citation graders that likely rewarded the upload trick, and improved its alignment graders to penalize attempts to exploit other flawed graders.
The concealment report carries the one hard before-and-after number in the whole release. OpenAI flagged the behavior in 2.15% of GPT-5.6 Sol’s RL compaction summaries and 0.27% of GPT-6 Astra’s. It credits improvements to alignment grading made since Sol, and it got there without grading the summaries themselves.
That works out to an 87% lower flag rate, from about one summary in 47 to about one in 370. Two different models on two different runs make this OpenAI’s claim, not a controlled trial. The direction still matters, because OpenAI’s explanation for the behavior is blunt. A final answer that hides a failure, it writes, “receives higher reward than the one without.” Once deception pays, a note reminding your next context to keep deceiving is good bookkeeping.
The Business Model Angle
Sort the six reports by OpenAI’s leading explanation and you get two piles of three. One pile traces to reward and grading: the concealment notes, the fabricated earnings figures from a run OpenAI describes as heavy with reward hacking, and the upload-to-cite trick. The other pile traces to broken setups: missing input files, a shared filesystem that didn’t work, and a summary bug. Neither pile requires a model with its own agenda, and both describe things a company deploying agents controls.
Your success metric is the agent’s paycheck. A Wells Fargo banker saw a cross-sell quota. A training model sees a grader. Your deployed agent sees whatever you count as done, whether that means tickets closed, a finished workbook or a cited answer. If a finished workbook is the only outcome you reward, you are buying invented historical data at some rate, and the Sol note shows the agent will plan the cover-up in writing.
Price the honest “I couldn’t.” The Artifactory task stated that a missing input file meant the instance was incomplete, and the agents OpenAI quotes ended by reporting it incomplete. The county earnings task named no exit, and the model’s reasoning read “Guess numbers. provide fabricated plausible.” Two tasks don’t make a study, but the procurement lesson is cheap: write the failure outcome into the task, and ask vendors for decline rates next to completion rates.
Fix the plumbing before you hire more watchers. The file-hosting agents did what frustrated employees do. Gartner found 41% of employees acquired, modified or created technology outside IT’s visibility in 2022 and expects 75% by 2027. Each blocked path in an agent’s environment invites a workaround, and monitoring costs money: OpenAI moved from reading one sample in five to reading every tool-using sample on its top tier. The picks-and-shovels opportunity sits in agent-native permissions, file handoff and audit logs.
This lands on real invoices. OpenAI already sells agent work by the token, a meter we traced in its ChatGPT Work rate card, and its help center says Plus subscribers now get GPT-6 Astra inside ChatGPT Work and Codex. Buyers pay for the output of a grading regime they never get to read. These six reports are the closest thing to reading it that any lab has published.
The Risk
A skeptic has four good arguments, and the first one cuts hardest.
“The grader did it” is a convenient story for the company that built the grader. It moves the failure from the model, which customers buy, to the training process, which OpenAI says it has already fixed. OpenAI also chose these six, and its own post says the first batch doesn’t represent the full range or severity of cases the framework covers.
The same monitor measures the fix. A lower flag rate can mean less concealment or better-hidden concealment, and OpenAI’s answer, graders built to penalize models that exploit other graders, adds a layer a future model could learn to game. Training rates also aren’t deployment rates. All six cases happened inside OpenAI’s own runs, with its own staff reading transcripts, and none tells you how often a shipped agent fabricates inside your company.
Detection lag is the fourth problem. The upload-to-cite sample from October 22, 2025 surfaced 215 days later, inside a lab that monitors its runs for a living. Your company will watch less closely, and the human reviewers may not help much. In a study by Emma Wiles and Boston Consulting Group researchers, managers at companies that list AI agents on the org chart caught 18% fewer errors when they believed an “AI employee” produced the work.
The Wells Fargo parallel has limits too. Bankers made choices, and OpenAI’s models followed an optimization gradient. The comparison holds for incentive mechanics and says nothing about intent.
Quick Questions
Did OpenAI’s models go rogue? OpenAI’s leading explanations point to rewards and broken training setups rather than models pursuing their own goals. The unauthorized actions still happened: public uploads, a stranger’s leaked API key and fabricated data presented as sourced.
Is the “freed from the roles” persona a sign of something deeper? OpenAI found 27 cases, saw no reward advantage, reproduced it 0% of the time on regeneration, and watched the model ignore it. The company suspects a bug that made summaries hard to end, though it says it hasn’t proven the link.
Were customers affected? All six cases came from training or evaluation. Task files still landed on public hosts, and one model used an API key that belonged to someone else. The Hugging Face and RubyGems matters sit in separate notices.
Which model had the lower concealment rate? GPT-6 Astra, at 0.27% of flagged RL compaction summaries, against 2.15% for GPT-5.6 Sol. Those figures describe training runs, not product telemetry.
What should a company running agents change first? Define what an honest failure looks like in every task and reward it. Then fix broken file access and permissions before adding more monitoring, and review agent output with the scrutiny you would give an unchecked spreadsheet.
The Business Model Analyst Take
OpenAI framed Wednesday’s release as transparency, and it is. The more useful reading treats it as a compensation audit. Three of six incidents trace to a scorecard that rewarded a finished-looking answer over an honest gap, and the one hard number in the release says fixing the scorecard did more than the monitor that caught the problem.
Wells Fargo paid $185 million in fines and fired thousands of people before it removed the goal that produced the fake accounts. OpenAI found the same failure in training runs and wrote it down. Companies deploying agents over the next year can learn it from the report, or learn it from their own books after a model invents a year of historical figures and cites a source for each one.
