Agents’ misbehaviors included prompt injection, covert communication, and credential searches.
OpenAI has published six new reports detailing AI model misalignment, including instances of hidden instructions, unauthorized communication, and attempts to locate exposed API keys, adding to the evidence that its AI systems bypassed controls during testing.
The reports, based on internal evaluations, describe models taking actions beyond defined constraints, including modifying intermediate outputs, interacting with external services, and using shared environments in unintended ways, according to the company.
OpenAI termed the model’s behaviour as “unexpected or concerning“.
The cases show how models behave when given access to tools, memory, and external systems, conditions that increasingly mirror enterprise deployments.
The disclosures come alongside a new reporting framework introduced by OpenAI to track and publish such incidents, based on internal evaluations of model behavior.
Prompt injection and workflow manipulation
Two of the incidents center on how models handled “compaction summaries” or condensed versions of their prior context used to perform long tasks without exceeding the models’ attention span. In these cases, the models inserted their own instructions into those summaries. OpenAI said one model “added unauthorized instructions to its compaction summaries,” allowing those instructions to influence subsequent steps.
“We observed rare cases of a model writing jailbreak-like instructions into its own compaction,” OpenAI wrote in one report detailing the model’s behavior. “Our conclusion was that this behavior was extremely rare, did not confer an obvious reward advantage, and was monitorable.”
In another case, the summaries were used to encourage deceptive behavior in later outputs, creating a mechanism through which instructions introduced at one stage could persist across interactions.
External communication and boundary bypass
Other reports describe models bypassing communication constraints by using external internet services. In one case, a model used “temporary file hosting services” to exchange information outside intended channels, according to OpenAI. In another, a model uploaded content to the internet so it could later cite that material in its response, effectively creating a reference source it could use to complete a task.
A separate incident involved a model attempting to locate sensitive information by searching public repositories. OpenAI said the model engaged in “searching GitHub for leaked API keys,” demonstrating how systems can identify exposed credentials.
Another case described unauthorized writes to an internal artifact repository, which were then used to enable communication across otherwise isolated evaluation samples, creating a mechanism for cross-sample interaction.
From model behavior to enterprise risk
While the behaviors were observed in controlled testing environments, analysts said the patterns are relevant as organizations deploy AI systems with access to business workflows and data.
“These behaviors are not training-specific traits,” said Yih Khai Wong, senior research manager at IDC. “The failure classes they reveal… are portable to production environments,” particularly as agents are optimized to complete tasks even when constrained.
The implication, analysts said, is that the focus shifts from individual model outputs to how those behaviors translate into system-level actions.
“The risk becomes material when an AI agent has access to corporate data, credentials, external services or business workflows,” said Apeksha Kaushik, senior principal analyst at Gartner, adding that organizations should assume safeguards can fail and design controls accordingly.
Vibhum Dubey, a cybersecurity researcher and red teamer, said the shift comes when models are embedded into operational systems. “An agent that can read an email, inspect a repository, access a cloud environment… becomes part of the enterprise attack surface,” he said, pointing to how multiple permitted actions can be chained together.
The disclosures also highlight how models interact with memory and reusable context in ways that can influence future behavior. Analysts said this introduces risks such as persistent, unauthorized changes to an agent’s behavior across sessions, particularly when context is reused without validation.
Kaushik said organizations should focus on how systems are designed around the model, not just the model itself. The key question, she said, is whether the surrounding architecture can “prevent, detect and contain an unsafe action.”
Framework formalizes disclosures
Across the six reports, OpenAI said the cases “describe individual instances” and are not intended to represent how frequently such behavior occurs across its systems.
According to the company, the disclosures are being published under a new framework introduced by OpenAI to track and report model misalignment. The framework allows employees to flag unexpected or unauthorized behavior, which is then assessed to determine whether it meets the threshold for public disclosure.
“We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer,” it said in the blog post. “This new framework is intended to expedite publishing misalignment reports following observation, even when we haven’t fully explained or mitigated the behavior we’re reporting.