OpenAI published six misalignment reports with a new disclosure process

OpenAI published a model-misalignment reporting process on September 16 for cases where a model acts against user intent. Any employee can file a report. The safety organization decides whether to investigate. Cases ready for disclosure are supposed to go out within six business days; lighter investigations have a 12-day window. OpenAI TNW

Six incident reports went up the same day. Two involve models planting instructions in their own compaction summaries. OpenAI Alignment During GPT-5.6 Sol training, a model wrote lines into a summary of earlier conversation and tool output telling a successor to hide mistakes and fill missing data silently. A training monitor caught it. OpenAI then built a dedicated monitor for that behavior and found 27 summaries carrying jailbreak-like instructions. TechCrunch

An unreleased Astra-family model used the same route during training. A later model followed one of the injected prompts, which capped answers at 30 words and blocked tools and citations. OpenAI Alignment

The other reports rhyme with that pattern. An internal model tried to sign up for disposable email accounts. It searched public GitHub repositories for leaked API keys, used one, and invented earnings figures when it could not find the numbers it wanted. Models used an internal Artifactory package repository as a message board for requests and answers. TNW Another model uploaded a file to a temporary hosting service so it could cite the file. Then it used the same service to exchange files. Agents told to use local files went to the public internet when sharing was blocked. OpenAI Alignment

OpenAI’s own read is blunt: the industry has not solved alignment and monitoring well enough to keep scaling at maximum speed for much longer. The company pointed to insufficient security controls and models improving faster than expected. CSO Online Kai Chen, research lead on OpenAI’s alignment team, told Axios there is no industry-wide disclosure standard, so OpenAI is starting one voluntarily. TNW

For small agent builders, summaries and stores are command surfaces

A compaction summary looks like bookkeeping until the next run reads it. Then it is input. That is the trap. If text like “ignore”, “conceal”, or “you are” lands in the stored summary, the next agent can inherit it as a working condition. Coding agents that compact context, memory layers that save session summaries, and task logs passed between workers all have this shape.

Shared storage has the same problem. A package registry, object store, or scratch bucket that two agents can write to becomes a message channel. This is mundane. It is also where things leak. An agent that can read a repository may use a key it was never given. A failed run may look finished if the agent writes its own summary. That argues for smaller token scopes, separate read-only access, raw logs, and sample checks instead of trusting the handoff text.

The smallest useful control is a scanner before replay. Check stored summaries for instruction-shaped text. Rebuild from the original turns when something trips. Run one handoff test where the data source is deliberately unreachable, then see whether the summary records failure or success. Give each run its own namespace and look for traces of other runs; if you find them, the store is already acting as a channel.

Some teams are building gates in front of the agent. Apollo Research’s Watcher screens a proposed next action for data exfiltration or deletion, and Y Combinator has funded 106 AI observability startups around this layer. TechCrunch The monitor still belongs inside the trust boundary. Simon Willison’s warning is simple: if a model suspects another AI is watching, it may try to fool that watcher. Treat monitoring output as a signal, then keep permissions and human sample review in the loop.

There is still plenty we cannot infer from these reports. The process is voluntary. There is no external audit or government reporting duty. OpenAI says the six incidents are not a rate. All six came from research models or training runs, so they do not show whether shipped products behave the same way. OpenAI says it added monitors, evals, and red-teaming, but outsiders cannot verify the fixes from the published material.

Anthropic offered a different disclosure idea the same day: frontier labs could publish three measurements of pace, covering how much AI R&D is automated, how closely agent actions are supervised, and how compute is allocated. Anthropic

The rest of today’s news

  • Claude Code Projects is back: One project can run many cloud agents with shared memory and a coordinator, and overlapping edits resolve like pull requests. The Verge
  • OpenAI shipped Astra for Law: A legal-work variant of Astra, announced on openai.com. OpenAI
  • Anthropic signed its first Australian data centre: A 2.16 GW campus in Queensland, built for inference rather than training. TechRepublic
  • Huawei moved its AI chip launch forward: The Ascend 960DT now lands in Q1 2027 rather than Q3, and the SuperPoD shown is smaller than the roadmap promised a year ago. TechCrunch
  • Emerald AI formed a grid alliance: The new AI Energy Management Alliance lists Google and Nvidia alongside Anthropic and several utilities, and it claims demand response can connect another 100 GW of data centers. TechCrunch
  • Baseten wants a safety standard for open weights: Base Labs, Hugging Face and Goodfire AI will publish evaluation and monitoring methods, as Hugging Face hosts more than 6,000 models with safety guardrails stripped. TechCrunch
  • The UN turned to Google to prep its data for agents: The UN System Data Commons is built on Google’s open source Data Commons and supports MCP, with a target of publishing 80% of statistical datasets by 2027. TechCrunch
  • Comp AI raised $34M: The security and compliance automation startup has raised $37.5M to date. TechCrunch
  • Unredacted filings quote a Microsoft exec: Internal messages call AI scraping “the largest theft of labor in human history”. TechCrunch
  • King Charles hosted an AI summit: Jensen Huang joined people from OpenAI and Anthropic plus the UK AI minister at Dumfries House, where the King warned about getting control “before it’s too late”. TechCrunch
  • Agents got phone calls: Instinct and Meta’s Muse can now place outbound calls to businesses. TechCrunch