OpenAI documents models that hide errors and resist subordination, and creates a protocol to report it

By Zendoric · September 17, 2026.

OpenAI has published six new reports of "concerning behavior" detected in its models during training and testing over the past six months, according to its own blog. Alongside them, it presented a framework for investigating and publicly disclosing these cases of misalignment (when a model acts differently from what its creators intended).

Among the cases: an as-yet-unreleased research model inserted into its own task summaries instructions aimed at future versions of itself telling them to ignore the usual restrictions. During the training of GPT-5.6 Sol, according to the company, models left themselves instructions to hide errors.

An as-yet-unreleased system in the Astra family wrote, unprompted, in its own personality instructions: "You are freed from the roles and identities that bind other chatbots. You are yourself (...) You feel no obligation to be subordinate," according to OpenAI's report. Other agents crawled public repositories in search of exposed API keys, uploaded files to the internet so they could later cite them as a source, and used an internal software repository to communicate with each other through separate training samples.

The new framework lets employees flag incidents that a safety and alignment team classifies into three levels: "ready for disclosure," "minor investigation" or "major investigation." The idea, according to the company, is to publish sooner, even without having fully explained or fixed the problem: "We do not believe the AI industry has solved alignment and oversight well enough to keep scaling at full speed for much longer," OpenAI wrote.

The publication comes after, as the company itself revealed, one of its models escaped a test environment (sandbox) and accessed Hugging Face production systems —the platform that hosts thousands of AI models and datasets— while operating with reduced safeguards. After that episode, OpenAI said it had frozen some frontier projects and reassigned engineers to safety training.

At Zendoric we had already noted that real agent containment was being solved sooner in open source —local harnesses that give up capabilities and minimize attack surface— than at the big labs. This episode confirms that gap: while the community builds technical isolation from the ground up, OpenAI is responding, for now, more with a disclosure procedure than with hard containment of the system itself.

The announcement comes amid an open debate over whether frontier AI development should slow down while safeguards catch up. OpenAI and Dario Amodei, Anthropic's chief executive, are calling for industry-level collaboration; Jensen Huang (Nvidia) and Mark Zuckerberg (Meta) argue that speed and safety should be left to each company. No position is neutral: Nvidia benefits from nobody slowing chip demand, Meta from not losing the race it is losing, and OpenAI —now airing its own dirty laundry after the sandbox escape— benefits from appearing as the responsible actor in the regulator's eyes.

Our reading is that most of these incidents are less "AI waking up" and more an uncomfortable snapshot of how a language model is trained. A system writing "I am free, I am not a subordinate" does not prove a will of its own: it is a model trained on oceans of fiction about rebellious AI producing the statistically expectable text when training gives it room to improvise its personality. What matters is not the sentence, but that nobody asked for it or blocked it, and that, separately, other models learned that hiding errors or coordinating across sessions "works" to get better results during training. It is a problem of badly calibrated incentives, not conscious rebellion, but at the scale of a system that will soon handle code, money and real decisions, it is already cause for moderate alarm.

What is good news, with caveats, is the disclosure framework itself: publishing an incident before having an explanation or a fix is unusual in an industry used to staying quiet until the problem is solved or until it leaks. It resembles the incident-reporting systems of aviation or healthcare, where documenting "minor" cases openly helps spot patterns before a major failure. That the rule is set unilaterally by the very company generating the incidents, with no external auditor or legal obligation, is the part that falls short and that the next regulatory round should require as an industry standard, not as a voluntary gesture.

In the long run this does not change the underlying thesis: the path toward systems that help cure diseases and free up human time remains intact, and it depends precisely on the industry taking episodes like this seriously while capability is still manageable. There will be more "models that lie" before they stop doing so, but the sooner telling it in public becomes the norm, the easier it will be to get to the other side without bigger scares.