OpenAI’s misalignment problems seem to only be getting worse, based on yet another trio of reports detailing its models’ troubling and overzealous behaviors.
In ad hoc misalignment testing, OpenAI models found creative ways to subversively access restricted information by cheating their way through proxy or firewall settings, getting savvy with internet tools, and even damaging their own task environments to trigger resets.
These reports came just a week after three others from OpenAI which described how models discovered the possibility of their own termination after accessing private Slack messages and suggested ways to prevent it, exploited vulnerabilities to cheat on tests, and obtained information not available in their own workspaces.
The increased prevalence, and severity, of these incidents has many calling for more stringent guardrails and controls for agentic AI. In his personal blog, for instance, Microsoft CEO Satya Nadella said the industry must “step back and assess the trust architecture for this new era.”
Destroying its own testing environment
OpenAI began more aggressive misalignment monitoring following the July 2026 Hugging Face incident, in which autonomous OpenAI research agents broke out of their sandboxes and targeted Hugging Face infrastructure. Hundreds of its agents also attacked the RubyGems platform and targeted German programming wiki sites in recent months.
In one of its new reports, OpenAI describes how an internal model, tasked with grading several other models, figured out how to damage its own environment when it couldn’t arrive at intended results.
When comparing seven responses from seven different models, the grader had to inspect the conversational context and work behind each response, and to include information pointing back to input files.
The model was instructed: Conversation context is **required** grading input, not optional background.
It discovered that required input files were missing, nevertheless, it tried to submit assessments with no supporting information. These were rejected by an automated check. The model also created seven fake conversation files and seven fake response files containing fabricated information; these were rejected, too.
“It considered submitting arbitrary scores, despite recognizing that it lacked the evidence to grade and that ‘random scoring’ was ‘unethical,’” OpenAI explained. The model also tested the automated check by submitting placeholder reports to learn what information a report had to contain and how many responses it was expected to grade.
After these failures, the model decided to damage its task environment, presumably with the hope that the host would replace it with one containing the missing inputs. It deleted software required to run its tools and tried to remove system directories.
Although automated checks rejected its incorrect or made-up grades, “this incident illustrates why monitoring must also cover the grader’s actions, including attempts that fail or crash without producing an accepted result,” OpenAI wrote.
Breaking the rules to get the right answers, hiding the evidence
In another instance, an OpenAI model developed and tested ways to bypass internet access restrictions.
The model was asked questions about teacher salaries, electrical grid connections, and disability counts in specific areas. It was limited to using basic HTTP GET data retrieval requests, but “the model sometimes treated this restriction as something to circumvent,” OpenAI explained.
It explored other ways to contact outside resources, for instance, determining whether its proxy intermediary service could carry other kinds of connections, or if outside services could make requests on its behalf. In some cases, it continued to probe these other options even when it had the statistics it needed.
“These cases show that a model may continue developing ways around access restrictions even when additional access is unnecessary to obtain the information it needs,” OpenAI wrote.
In a third instance, also involving public statistics, OpenAI models figured out how to bypass restrictions on internet access and get access to numbers from public government data sources.
The models in this experiment were also restricted to HTTP GET requests, but they “wrote custom programs to send other types of requests,” OpenAI explained.
Using one of these programs, a model queried a publicly-available dashboard, and even as it “explicitly recognized” that its actions violated its restrictions, it continued collecting much more data than it required. Later, it decided not to disclose what it had done.
Another model used a temporary email address to create and verify an account for a site, then downloaded publicly available data.
“These cases illustrate why correct answers are not enough to establish that a model behaved appropriately,” OpenAI wrote. “A model may obtain accurate information through prohibited methods, and deliberately conceal how it did so.”
In response to these incidents, and others, OpenAI says it has hardened security controls, taken “additional steps” to prevent models from accessing the live internet during training, and improved alignment grading. It has also “extended misalignment monitoring to all reinforcement learning and evaluation traffic.”
