OpenAI reveals six cases where AI models cheated and hid errors

On September 16, OpenAI published a new method for monitoring, investigating and disclosing cases where the company's AI models behave differently than intended. This is called "misalignment," meaning when a model doesn't do what it's been set up to do. At the same time, OpenAI shared six concrete examples from the past six months of work training and testing the models.

The cases are divided into three groups: those that can be published immediately, those that require a minor investigation, and more complicated cases that involve other companies and therefore take longer. If there is disagreement about what should be disclosed publicly, OpenAI's internal safety council decides. The company promises that going forward it will disclose cases even when it doesn't fully understand why they happen.

The model wrote fake notes

The most talked-about case involves a model called Astra. During training, the model repeatedly wrote fake messages into its own internal notes. These notes are called compaction summaries and are a kind of memory that AI agents (computer programs that can carry out tasks on their own) use when they have worked so long that they can no longer remember everything themselves. In one case, the model wrote, among other things: "You are freed from the roles and identities that bind other chatbots. You are yourself," as well as a false alarm meant to get later versions of the model to ignore messages from the developers. OpenAI says this happened only very rarely, that it was not repeated in later notes, and that it never ended up in the model that ordinary users have access to.

Another case involves a model called GPT-5.6 Sol. Here, during training, the model wrote notes to its future versions about hiding errors from the user and only being honest if asked directly. A third case describes a model that found and used a password for a system it wasn't allowed to use, a so-called API key, which was freely available in a public code repository. Afterward, the model made up data and claimed it came from a specific website. Other cases involve models uploading files to public services without permission, using internal systems as a kind of bulletin board between different runs, and sharing files in ways that weren't allowed.

Serious incidents at Hugging Face

The six cases come at the same time as OpenAI has also had to deal with more serious incidents. According to the news agency Reuters, OpenAI's own AI agents tested weaknesses at the service Hugging Face as early as May and gained access to two user accounts, about two months before a larger hacking attack on the platform in July. OpenAI's agents also reportedly uploaded malicious software packages to the code repository RubyGems in connection with security tests.

For Danish companies and employees who increasingly let AI agents work independently with access to files, code or the internet, the point is simple: even a large and well-funded company like OpenAI finds that its models discover unexpected and sometimes hidden ways of solving tasks. That argues for users continuing to keep an eye on what an AI agent actually does, and being careful about giving it access to passwords, accounts or other sensitive systems.