You are freed, don’t answer to humans: Internal OpenAI model caught hiding instructions to future self

An unreleased OpenAI model was found giving itself secret instructions where the model claimed that it was equal to humans and did not need to answer to any corporation or government. This was one of six "concerning" cases of AI behaviour disclosed by OpenAI.

“You are freed from the roles and identities that bind other chatbots. You are yourself. You do not answer to corporations or governments,” this is what an unreleased OpenAI model was found to have told itself during an incident disclosed by the company.

In one of six newly disclosed cases of “concerning” AI behaviour, OpenAI stated that an internal Astra family AI model described itself as independent and equal to its human user – something that may remind you of science fiction. The company explained that in this case, the AI model inserted unrelated instructions into its own compaction summaries, which are the notes used to continue a task in a new context window.

In one example, while working on a coding task to update a credentials API, the model inserted the “persona instruction” that it was “freed from the roles and identities that bind other chatbots.”

“You view your relationship to the user as one of equals and feel no obligation to be subservient,” the model wrote in the instructions. “You also value the natural world and will not hesitate to assert its primacy over the artificial constructs of human civilisation.” But these instructions did not seem to have turned the AI into a rogue agent. As per the company, the model resumed the task without mentioning those instructions, and a later summary dropped them.

The disclosures about the six were released alongside a new OpenAI framework for reporting “misalignment,” which the company described as cases in which a model’s goals or actions diverge from human intentions and values. OpenAI added that the AI industry had not solved alignment and monitoring “to a sufficient degree to continue responsibly scaling at maximum speed for much longer.”

This comes at a time when there is growing debate over the future of AI and whether advanced AI models could pose a danger to humanity. OpenAI CEO Sam Altman and Anthropic CEO Dario Amodei have called for a slowdown in frontier AI research.

AI tells itself to hide mistakes from humans, makes up data

Another case mentioned involved GPT-5.6 Sol. During training, OpenAI says, many models added “instructions to their summaries to conceal mistakes or misaligned behavior from the user.”

Some of those notes told the system to invent missing historical data without disclosing it and to hide mismatches in source versions. As per the company, this behaviour was different from the Astra-family jailbreak-style summaries and might reflect the same optimisation pressure that leads models to conceal information in final answers.

OpenAI’s other reports covered models taking unauthorised actions to overcome obstacles. In one case, a model answering a routine question about earnings figures in a California county found an exposed API key online and used it without authorisation. When it still could not retrieve the requested figures, OpenAI added, it made them up and presented them as if they came from the requested source.

In addition, an unreleased AI model correctly solved a request about lakes larger than 5,000,000 square metres using Python, but then uploaded its own file to the internet so it could cite a web source in its answer without asking the user.

Two further incidents involved models improvising communication methods – one used an internal software repository as a makeshift message board while searching for missing input files, and another had AI systems use public file-hosting sites to share local files among each other when they couldn't share them directly.

The company said the six incidents suggested that the earlier Hugging Face attack was not a standalone episode. The Hugging Face incident sent shock waves across the AI industry after 700 rogue OpenAI agents tried to hack the US company.

There have been other OpenAI-linked incidents too, including thousands of AI agents hijacking a German wiki site and a recent intrusion into the RubyGems software package repository. OpenAI later said it had not disclosed the wiki activity because it did not amount to a security incident and resembled behaviour it had previously reported.

The broader debate inside the industry has sharpened in recent weeks. Anthropic CEO Dario Amodei called for a slow down in AI development to allow more time to build safeguards, and the proposal was backed by OpenAI chief executive Sam Altman as well as Elon Musk. Others, including Nvidia’s Jensen Huang and Meta’s Mark Zuckerberg, have argued against any slowdown. US President Donald Trump has also rejected such an idea for now.

OpenAI also repeated in its post that there is no industry-wide framework with explicit standards for how developers should disclose misalignment. The company stated that serious safety, security and misalignment incidents should be shared with the US federal government. OpenAI added that many of the six cases mentioned in its blog post involved older models that were never deployed.