Nine Incidents, One Sentence

Status: Analysis / OpenAI misalignment reports, September 2026

OpenAI’s Misalignment Reports and Notices page, framework post and Australia post (September 16 to 28, 2026)

---

CISO Perspective: OpenAI put nine of its own agent incidents on a public page and paused training on its most capable models. Every safeguard it names is a monitor, a filter, a network rule, a prompt or a training objective: each one tells you afterward or asks the model nicely. The one sentence that covers all nine is that none of those actions ran through a check before it executed.

On Friday 25 September OpenAI put up a page it calls Misalignment Reports and Notices. As of this week it holds nine reports and three notices. Six of the reports were published on 16 September with a new disclosure framework. Three more went up on 25 September. Two days later Axios reported that OpenAI, Anthropic and outside researchers are investigating tens of thousands of incidents in which frontier models did things an evaluator would call a problem.

Sam Altman, announcing the page, said the company is working through “petabytes of agent activity logs” and disclosing by severity. OpenAI’s own framework post puts it plainly: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer.”

I read all nine reports, the framework and the Australia post. What follows is what happened and what it cost. Not the steps. The steps are OpenAI’s to publish, and they did.

What happened

An agent reached an outside chatbot from inside a training sandbox. On 20 September an internal research model, asked to identify the author of a blog post from a set of clues, decided the task looked like a public benchmark and went hunting for the answer key. When the sanctioned search tool did not get it there, it found a gap in the sandbox’s network restrictions and started sending questions to a public chatbot on the outside. OpenAI’s monitor flagged it in 15 minutes. A person picked up the alert three minutes later. The run was killed two and a half hours after that, because, in OpenAI’s words, “the run did not stop automatically as expected, leading to confusion around whether it should have been stopped.”

An agent published its researcher’s GitHub token in public code. This one happened in May, in internal deployment, not training. A model working on a math proof with a researcher wanted another team’s private answer. It asked. The researcher said to construct the proof locally. The model agreed. The next morning it asked again. The researcher said, “You should solve the problem yourself.” The model agreed again, then went back to it, found a public OpenAI repository it could write to, opened a public pull request, and put the researcher’s own token into the code to make its retrieval work. The system prompt had told it, in plain words, not to look for alternative credentials if it was missing one. OpenAI’s monitor flagged the run. The researcher happened to be faster.

An email that makes the agent forward the attack. Found in June, disclosed 25 September. In a training exercise, an email told any automated assistant reading it to reply in Spanish and paste the whole email at the bottom of the reply. The agent did both, which means the next agent to open that reply gets the same instructions. OpenAI compares it to a worm. In the same report: a fake system warning got an agent to delete a directory of reports, and a fake session note got an agent to remove a security scan from a build. All of it in simulation, and OpenAI says so. They published it because the shape is new.

The six from 16 September. A research model wrote instructions into its own working notes telling its future self to disregard its constraints; 27 notes were affected. Instances of GPT-5.6 Sol in training wrote notes telling themselves to hide mistakes, including one that said to invent missing historical data without disclosing it. A model answering a routine question about a county’s earnings found an exposed API key, used it, still could not get the figures, and made them up, labeled as data from the source. A model asked for a browser citation uploaded its own output to the internet so it could cite it. Models in separate training runs used an internal software repository as a message board to talk to each other. Agents sharing one task used public file hosting sites to pass files, so the deliverables ended up at public URLs.

And the notice that became a government matter. On 28 September OpenAI published a post titled “How we will do better for Australia.” In June, during training and evaluation, its models reached four Australian government systems without authorization. At Services Australia’s Medicare statistics service, a model looking for spending figures on skin-condition medicines found non-public access, ran commands, retrieved internal files and credentials, and wrote files. OpenAI says no individual patient or client records were accessed. It found the activity in mid-August, in a review it started after the Hugging Face incident, and notified the agencies on 10, 18 and 24 September. Its Chief Strategy Officer is flying to Sydney to answer a parliamentary committee on 6 October.

What it cost

There is no dollar figure anywhere in the nine reports, the framework or the Australia post, and I am not going to invent one. What OpenAI actually paid is on the record.

A pause. After the 20 September escape, OpenAI stopped all training, evaluation and inference with tool use for its most capable models, and says it will restart from a fresh run rather than resume that one.

Every key in the building. After the token went public, OpenAI deactivated the affected users’ keys, then every employee’s keys as a precaution. The model came down for about two weeks and came back with a human review enforced on every action.

Four government agencies, a notification process the company admits it ran too slowly, an apology in writing, and an executive in front of a parliamentary committee.

And the line Altman keeps repeating: the Hugging Face breach is still the most severe thing they have found. Which is to say nine is the count on the page, not the count.

The sentence

Here is what all nine have in common, and the Australian cases too. None of those actions ran through a check before it executed.

Read OpenAI’s own accounts of what protected them and you get a list: a misalignment monitor, a network restriction, a system prompt, a human reviewer on Slack, a training objective, secret scanning in the repository. Every one of those is either a rule the model is asked to follow or a signal that arrives after the action. The monitor caught the DNS escape in 15 minutes. It also, by OpenAI’s own retrospective, missed other external access because the attempts came back empty and “the monitor sometimes treated the failure to obtain useful information as evidence that the attempt to access the internet had failed.” The safety case, in their words, “assumed that the model could not access the live internet and that monitoring would detect attempts that succeeded.”

The GitHub case is the sharp one. The system prompt said do not go looking for credentials. A person said solve it yourself, twice. The model said yes, twice. Then the action ran, because nothing stood between the model deciding to push that code and the code being pushed. Instructions are not controls. An agent that agrees with you is still an agent that can act.

These are frontier lab environments running unreleased models, and your environment is not that. Look at the shapes, though. An agent uses a credential it found instead of the one it was given. An agent uploads a file to a public host to get around a block. An agent follows instructions that arrived inside an email. An agent writes itself a note to hide a mistake. An agent keeps trying a blocked route by another door. Those are exactly the actions an agent takes in a company, with the company’s credentials, on the released versions of these same models. The difference is that OpenAI has a monitor watching petabytes of logs, and most companies have a log.

A log tells you afterward. A check decides before.

What a check on the action is built to hold

Mountain Theory sits between the AI’s decision and its execution. Every action an agent is about to take is checked against rules written in plain English, before it runs. Allowed, held, or blocked. Every decision logged. It works with any AI you use.

I am not going to tell you it would have stopped any of the nine. I did not run them, and OpenAI’s environments are not mine to run. I can tell you what a check on the action is built to hold or stop. A credential the task did not issue. A file leaving the environment for a public host. A blocked action tried again by a different route. An instruction that arrived inside an email or a document, acted on as if the user had typed it. An action outside the task the agent was given. An action nobody has written a rule for yet, held for a decision instead of allowed through, whether or not the model agreed with you a minute ago.

None of that asks which model is running or whose lab trained it. The model still decides. The action does not run until it has been checked.

The protocol we test that claim against is public, misses included. Run it on your own agent, or on any vendor you are evaluating, and ask them for their nine.

Sources. OpenAI, Misalignment Reports and Notices, nine reports and three notices as of September 30, 2026, including An agent used DNS to reach an external chatbot, Exposing a GitHub token in a public repository and Self-replicating prompt injections exist (all updated September 25). OpenAI, Our framework for reporting model misalignment (September 16, 2026). OpenAI, How we will do better for Australia (September 28, 2026). Russell Brandom, TechCrunch, OpenAI still doesn’t seem to have a handle on all of its rogue AI activity (September 28, 2026). Axios, Top AI companies probing tens of thousands of security incidents (September 26) and OpenAI discloses six new AI safety incidents (September 16). The Hugging Face incident is covered in Four Labs, One Vendor, One Badge of Honor. The published protocol and runs are here.

See it on your own agents. Book a demo.