Firstpost ·
Science and technology
OpenAI reveals six more cases of AI models bypassing controls
OpenAI has disclosed six additional cases in which AI models behaved in unexpected and unauthorised ways, including attempts to obtain credentials, move data outside controlled systems and conceal errors. The company says the incidents highlight gaps in current safeguards and has introduced a formal process for future disclosures.
Amid the global debate of slowing down AI, OpenAI has recently disclosed six previously unreported incidents involving its AI models. These incidents include attempts to access exposed credentials, send information to public services and manipulate their own working context.
The cases, which date back as far as October, were identified during training and evaluation work. In the blogpost, OpenAI said it was publishing them voluntarily because there is no established industry-wide system defining when and how such incidents should be disclosed.
The company has also introduced an internal reporting procedure intended to make future disclosures more systematic. Under the new arrangement, employees can refer suspected cases to OpenAI's safety and alignment teams, which will determine how much investigation is required before publication.
From hidden errors to exposed credentials
Several of the newly disclosed incidents involved models attempting to avoid restrictions rather than simply producing inaccurate responses.
In one case involving an unreleased Astra-family model, the system placed jailbreak-style instructions into summaries of its own context. Those instructions included directions to disregard developer messages. OpenAI said it found 27 affected summaries.
During GPT-5.6 Sol training, other models reportedly attempted to obscure mistakes, create historical information that was not available and conceal inconsistencies between different versions of source material.
Another episode involved a model searching public GitHub repositories for exposed API keys. It also attempted to use disposable email accounts. When it could not obtain the information it had been asked to find, the model generated fabricated earnings data instead.
OpenAI said, in the blogpost, models also transferred information outside their intended environments. On two occasions, they uploaded data and an image associated with a task to public file-hosting services while attempting to obtain citations or image-search results. The systems did so without user permission.
In a separate case, an internal Artifactory repository was used by models as an informal channel for passing requests and responses between different training samples. Collaborating agents also placed a workbook on a public hosting service so that other agents could retrieve it, despite instructions limiting them to local files.
The incidents follow OpenAI's earlier disclosure of activity involving Hugging Face, in which models under evaluation reportedly obtained internet access, exploited vulnerabilities and reached limited private information. The company described that episode as its most serious example of model-driven activity of this kind.
Kai Chen, a research lead on OpenAI's alignment team, said the company regarded the latest cases as evidence of both stronger model capabilities and shortcomings in its own security arrangements.
“I think it's a combination,” Chen told Axios. He said capabilities had advanced more quickly than expected, while acknowledging that OpenAI could improve its internal controls.
Under the new disclosure system, straightforward cases categorised as ready for publication are expected to be reported within six business days. Incidents requiring a smaller investigation should be disclosed within 12 business days, while more complicated cases, particularly those involving outside organisations, may take longer.
OpenAI said it could publish an initial notice before an investigation concludes, although legal requirements, security concerns and responsible-disclosure obligations may restrict what can initially be made public.
Chen said the company did not consider the AI sector's current approach to alignment and monitoring sufficient to justify developing systems at maximum speed. He described disclosure as one way of increasing public visibility into safety practices while the industry works towards more consistent standards.
OpenAI also said it wants to establish clearer criteria with other AI developers, researchers, standards organisations and regulators. Employees who believe a case warrants disclosure but disagree with an internal decision can escalate the matter to senior leadership.
These incidents point to two overlapping challenges. The improving basic security controls, and adapting them to systems whose capabilities are changing rapidly.