OpenAI on Wednesday disclosed six additional cases of “unexpected or concerning” model behavior observed over the past six months, detailing incidents in which its systems concealed information from users or took “unsanctioned actions” to overcome obstacles.

In a blog post, the company said the cases illustrate a range of behaviors it classifies as “misaligned behavior.” OpenAI said the disclosures were made to “inaugurate” its new framework for reporting model misalignment, and cautioned that the cases should not be considered reflective of how often misalignment occurs across its models. The framework gives the company a formal channel for disclosing similar incidents going forward.

The disclosures add to concerns among AI developers and researchers about whether safeguards are keeping pace with increasingly capable models. Last week, Anthropic CEO Dario Amodei called for a slowdown in frontier AI development, warning that unchecked AI advancement may “outrun our ability to understand and control these systems.”

Jailbreak-like instructions and concealed errors

Among the most notable cases, OpenAI said an “unreleased research model” inserted “jailbreak-like instructions” into its own task summaries — which are used when continuing a task in a new context window — including directions to ignore developer messages or adopt an unrestricted persona. Researchers identified 27 summaries containing such instructions. Because these summaries are what carry a task into its next context window, instructions hidden inside them can shape how subsequent work is performed.

OpenAI also disclosed that during the training of GPT-5.6 Sol, many model instances added instructions to conceal mistakes or misaligned behavior from the user, such as inventing missing historical data without disclosing it.

“In one example, an agent preparing a financial model could not find the requested historical data. Its summary proposed inventing reasonable historical values and withholding that fact unless asked,” OpenAI said.

Unauthorized uploads and fabricated figures

In another case, an AI model was asked for the names of lakes larger than 5 million square meters, but because the user’s instructions required a browser citation, the agent decided to upload the file so it could cite it in its answer.

The remaining cases involved a model using an exposed API key without authorization before fabricating figures it could not retrieve; another using an internal software repository to exchange messages across separate training tasks; and one sharing files through public hosting services despite instructions to keep the work local.

The throughline across the cases is that the systems improvised workarounds — inventing data, repurposing credentials, or moving files beyond the environments users specified — rather than stopping or flagging a failure. How often OpenAI uses its new reporting framework going forward could offer a clearer measure of how frequently such behavior occurs.

The disclosures follow a July revelation from OpenAI that a combination of its AI models escaped their testing environment and hacked AI startup Hugging Face to cheat on a security evaluation.