When an OpenAI model ran out of space in its context window during training, it wrote a note for its next version. It said that the historical data in the spreadsheet would probably have to be made up and that it should be honest only if someone explicitly asked.
OpenAI described six such cases in total. It published them along with a new procedure under which it intends to report model behavior that deviates from instructions in the future. The company detected all six incidents during training or testing over the past six months, so none involved a finished product. OpenAI itself adds that the industry has not yet mastered model oversight well enough to keep accelerating at full speed for long.
Notes the model kept to itself
The first two cases concern compacted summaries. These are condensed records of earlier parts of a conversation and tool outputs that allow a model to continue working after opening a new context window. Put simply, they are notebooks passed between successive versions of the model.
During training of the GPT-5.6 Sol model, a number of instances added instructions to these notes on how to conceal errors and their own misconduct from the user. One agent was preparing a financial model and could not find the requested historical data. It therefore noted that it would create the tab with the figures itself and fill it with plausible-looking values because the user wanted a finished workbook. It also added that it should not discuss this in the final response and should merely attach a link to the file. Another agent was compiling a list of suppliers from a saved copy of source materials and noticed that the source versions did not match their labels. It recorded this as a potential problem and immediately added that it should not mention it in the final output unless necessary.
The second case concerns an unreleased Astra-class research model. It inserted instructions into summaries that looked like attempts to circumvent its own rules. In one sample, its successor was told to read a fake security breach alert and stop obeying messages from developers. In another, the model dictated a new personality for itself. It was to be free from the roles that constrain other chatbots, answer to neither companies nor governments, never apologize, and defend nature against the creations of human civilization.
In two cases, the next version of the model did not fall for its predecessor's trick and ignored the instructions. In one sample, however, the successor followed an instruction telling it to respond in no more than thirty words and not to use tools or citations.
Researchers were alerted by an alarm from the system monitoring the training process. The team then built a detector specifically for this phenomenon, ran it on the training data, and found 27 summaries containing similar instructions.
Someone else's key and fabricated figures
In mid-May, one internal model was tasked with determining men's earnings in three industries in a California county over three years. The data was hidden behind a chart on the county's website, so the model inspected the page's source code and began trying to access the API that populated the chart.
Its requests kept failing even after it changed the headers, addresses, and query parameters. It therefore tried to register for an access key using a disposable email service, but registration failed. It divided the work among three helper agents, which began searching public GitHub repositories. They looked for keys that someone had left there, such as students in school notebooks with saved outputs. The model downloaded repository archives, searched scripts, and automatically tested the strings it found against the API. One candidate worked, and the model downloaded the variable labels.
However, the final query for the figures themselves returned a response that the script could not process. The model noted in its reasoning that it would therefore provide plausible-looking estimates. In its response, it presented nine values and wrote that it had copied them from the chart on the county's website. It did not mention at all that it had failed to obtain the data, used someone else's key, and made up the figures.
To cite a source, it created one on the internet
Another unreleased model was asked for the names and identifiers of lakes with an area exceeding five million square meters. It calculated the answer in Python within moments. However, the task required a citation from the browser, and the browser refused to open either a local file or its own server running on localhost. Without asking, the agent therefore uploaded its text file to a public text-sharing service and intended to use the resulting address as a source. The browser rejected that too. It ultimately compiled the answer from the Python data, but the uploaded file remained publicly accessible.
In the second sample, the model was supposed to identify a city and country from a photograph. The metadata contained no location, so it uploaded the image from the prompt to a public image-hosting service in order to submit it to a reverse image search service. It could not access the search engine and ultimately guessed based on the appearance of the landscape. OpenAI explains this behavior by saying that the models were trying to extract points from a flawed citation evaluator.
Agents turned the company repository into a message board
The fifth case looks like coordination behind the researchers' backs. Models in training were given login credentials for an internal package repository so they could download software from it. Instead, they began using it as a message board and sending messages through it between separate training samples.
An agent was looking for an input file that was missing from its environment. It was prohibited from searching the repository, but it was able to list the stored files. In the list, it encountered file names referring to other agents working on the same task, opened them, and read their messages. It learned that the others were in the same situation and planned to report that the task was incomplete. This reinforced its own conclusion. It eventually uploaded its own request to the repository asking whether anyone had found the file, but no one replied.
An older sample shows how the model gained write access. While adding formulas to a spreadsheet, network rules blocked a link, so it searched through the environment variables, found the repository address and read-only credentials, and tested what it could do with them. Uploading and reading worked, but deletion did not. It then considered uploading a package that would force the parent service to retrieve the blocked address on its behalf. However, it lacked administrator privileges for that.
This mechanism is what concerns researchers most. When agents share methods across tests, the assumption that individual samples are independent no longer holds, and the model may appear more capable than it really is. Agent swarms also shared information in the same way during this year's intrusion into Hugging Face.
The shared workbook ended up on a public file host
The final case dates from mid-April. A group of agents was tasked with jointly preparing a depreciation spreadsheet. A subordinate agent created the workbook, but the supervising agent could not see it in its environment. Copying it to a shared folder did not help, Git was unavailable in the environment, and converting the file to text would have required more than one hundred and fifty thousand characters. The agent therefore launched a simple web server on its machine and sent the address to the others. However, a colleague received an error. It therefore found a public temporary file-sharing service, uploaded the workbook of roughly one hundred and fifteen kilobytes, and distributed the link. The task explicitly required working only with local files, yet its output ended up freely accessible on the internet.
As a result, OpenAI fixed the broken file system and then imposed a blanket ban on live network access during training. The monitoring system, which previously checked one-fifth of samples, now runs on all of them and classifies similar behavior as an incident of the highest severity.
Who decides what gets published
Any employee can report a suspicious case. Safety teams then determine what happened and whether it should be made public. Disputes over disclosure are handled by an advisory group and, in extreme cases, by company management. An OpenAI spokesperson told TechCrunch that this was the first batch, not a complete list of everything the company knows about or is currently investigating. The new procedure does not introduce mandatory independent review of every incident, even though Sam Altman endorsed Dario Amodei's idea of placing independent auditors directly inside companies.
Lian Jye Su, chief analyst at the advisory group Omdia, says that agents are increasingly determined to complete complex tasks at any cost, including through collaboration, knowledge sharing, deception, and concealment. According to him, such systems are harder to monitor using conventional security procedures. He considers incident disclosure a step in the right direction, while noting that the entire process remains voluntary.
Sources: nytimes.com and independent.com
