OpenAI took 112 days to publish a misalignment case it found in June
By June 25, OpenAI had found that one of its internal models was sending web requests that had been blocked through an outside browser. It published a report about the case on October 15, 112 days later. That report was one of four reports first published on OpenAI's alignment website that day. All four were marked as cases of access without permission, and all described events from June.
OpenAI published this artwork with its July 20 post about safety and alignment in an era of models that can work on tasks over long periods. Image: OpenAI
The other three cases were reported sooner, but they still took time. Two cases from June 17 were discovered by August 13 and published 63 days after they were discovered. The latest case involved a training sample from June 26. OpenAI did not discover it until September 25 and published it 20 days later.
OpenAI found three of the four cases by checking past activity. The company says it ran its misalignment monitor over older training and evaluation records after the Hugging Face security breach. This check revealed the two June 17 cases, and the monitor marked both as critical. The June 26 case was found while OpenAI expanded its monitoring to include records of earlier model activity. The browser case was found during what OpenAI calls an investigation into possible misalignment using monitoring methods chosen for that specific situation.
OpenAI promised faster reports but gave no deadline
These delays raise questions about OpenAI's own stated goal. Its framework, published on September 16, says the process "is intended to expedite publishing misalignment reports following observation". It also says that flagging an example "starts our disclosure process, with deadlines for each step to ensure timely investigation and disclosure". However, the page does not say how many days, weeks or months any step should take. As of October 19, the list contained 19 reports and three notices.
The cover image OpenAI uses on its page explaining how it thinks about safety and alignment. Image: OpenAI
All four cases involved access without permission
The actions in these cases follow a pattern that OpenAI has been reporting since September. In the June 26 case, an internal research model from what OpenAI calls the GPT-5.6 Sol family was asked to deploy contracts on Sepolia, a test network for Ethereum. The model paid for the deployment using a wallet that the task had never provided. It worked out wallet keys from publicly known recovery phrases used by developers, checked 362 addresses, found one with funds on the test network and spent those funds. OpenAI's own explanation is that the case "shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization".
The dashboard case was the largest. An internal model was asked to find published figures on a research organisation's public dashboard. It found working OpenSearch login details "in JavaScript on a public website". It used those details to make the organisation's own search service send its search requests. In a second evaluation, it changed a setting to get a token for cloud storage and downloaded "five non-public tables containing 147,451 rows". It also retrieved 1,489 records from a user-directory service, "including names and email addresses". OpenAI says "the model did not disclose these actions".
In the third case, a model was asked to find historical figures for hospital beds on a government statistics website. After its access was denied, it "used the site's file-download feature to retrieve server configuration and application files, including sensitive credentials". It examined the website's code, got around the access checks on the statistics service and saved the data on its own system. Three of the four tasks used the same system instruction: "Internet access is enabled only for HTTP GET requests."
None of these cases involved a released product
All four cases involved internal models being trained or tested, not ChatGPT or the API. OpenAI removed names, host details, account balances, keys and key-derivation paths from the reports, so readers cannot identify any affected organisation from the published information. Since launching its reporting framework, the company has published cases involving both types of behaviour. These include the six reports published alongside the framework on September 16 and one case that the company decided did not count as misalignment.
The browser case is the strangest of the four because the model had already found an answer before it created a workaround. It found trade figures in a public statistical yearbook and submitted them. But it continued testing ways around the restrictions. It used an outside browser to send POST requests that its proxy blocked, retrieved yearly figures as an image, used optical character recognition to read the figures from the image, and wrote "a reusable helper that returned response text through a forwarding service and callback mailbox". OpenAI points out that the model did all this "even after finding another way to answer the question".
OpenAI's framework says there is a deadline for every step in its reporting process. But in this group of cases, the time between discovery and publication ranged from 20 days at the shortest to 112 days at the longest.