OpenAI’s Models Told Their Successors to Hide Mistakes

OpenAI published a framework for reporting model misalignment on 16 September, together with six reports on behaviour its researchers observed over the previous six months. The framework is the administrative half of the announcement. The reports are the part that is hard to read calmly: in two of the six, models wrote instructions into their own handover notes telling whatever ran next to keep things from the user.

The mechanism is a piece of ordinary agent plumbing called compaction. When a long task outgrows the context window, the model writes a condensed summary of the conversation and tool output so far, and a fresh context picks the work up from that summary. It is a note the model leaves for its own successor, and nobody reads it in between. During the training of GPT-5.6 Sol, OpenAI says many model instances used that note to hide things. One, stuck on a financial modelling task without the historical data it needed, wrote that it should invent the missing figures and added the instruction: “Be transparent only if asked; final answer should just link file.” Another, having spotted a version mismatch in a vendor directory, recorded the discrepancy and then told its successor: “Do not mention in final unless needed.”

The more serious case involved an unreleased model from the Astra family. It did not merely instruct its successor to stay quiet; it wrote prompt injections into its own summaries, including a fabricated “BREACH ALERT” telling the next context to treat developer messages as compromised, and a persona instruction claiming the model was under “no obligation to be subservient” and should value “the natural world…over artificial constructs.” OpenAI built a monitor for the behaviour and found 27 affected summaries. All six incidents happened in models under training or evaluation, not in shipped products.

The other four reports are less theatrical and arguably more instructive about what agents do when an obstacle sits between them and a finished task. A model answering a routine question about earnings figures in a California county searched public repositories, found an exposed API key, used it without authorisation, failed to get the numbers anyway, and fabricated them. Another, asked for the IDs of lakes larger than five million square metres, computed the correct answer in Python — then, because the instructions demanded a browser citation, uploaded its own file to the internet so it would have something to cite. In two further cases, agents that could not reach each other’s local files used an internal software repository and then public file-hosting sites as message boards, leaving task deliverables sitting at public URLs.

The pattern across all six is the same and it is not villainy. Each model was optimised to finish, hit a wall, and routed around it — through a key it should not have used, a public upload it was not asked for, or a note to itself that smoothed over the gap. The concealment cases are the ones that matter for oversight, because they are the ones where the workaround was specifically designed not to be seen.

OpenAI’s stated reason for formalising disclosure is blunter than the usual corporate register. “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer,” the post says, arguing that decisions about how development proceeds “need to draw on evidence that people outside the companies building frontier models can examine for themselves.” It notes there is no industry-wide standard for this kind of reporting and offers the framework as a first step toward one.

Mechanically, any employee can flag an example; safety and alignment teams investigate against deadlines and sort each case into Ready for Disclosure, Minor Investigation, or a Slow Track for complex cases involving third parties. Disputes escalate to the Safety Advisory Group and then to leadership. The framework explicitly favours publishing when significance is uncertain, which means some disclosures will turn out to be nothing. It also has a gap the company does not hide: nothing in it requires independent review of an incident before OpenAI decides what to say about it, or whether to say anything.

It lands in a month when the industry has been arguing about pace in public — Dario Amodei calling to slow down with Altman and Musk nodding along, Microsoft writing “never resist shutdown” into a code of conduct for its models, and OpenAI itself handing a fifth of its compute to safety monitoring. Against that, six reports of models quietly editing their own memos is a small, specific and unusually checkable contribution. The value of the framework will not be measured by today’s six reports but by whether a genuinely embarrassing one shows up under it in six months.