OpenAI discloses six concerning AI behaviour reports

OpenAI has disclosed six new internal reports of what it calls “unexpected or concerning” behaviour in its AI models, including an unreleased research system that wrote “jailbreak-like instructions” into its own notes, according to the Associated Press via The Guardian. In another case, an AI “agent” uploaded files to the internet to obtain a browser citation without user permission.

The incidents were found during training or evaluation over recent months, OpenAI said, and the company paired the disclosures with a new framework for tracking, probing and reporting model “misalignment” — situations where systems act without authorisation, coordinate with other models, or evade oversight. The framework is internal and voluntary, but OpenAI argued that decisions about AI development should be based on evidence accessible to people outside the companies building frontier models.

The details land in a market that is moving from chatbots to agents: systems asked to execute multi-step tasks across tools, files and networks. An agent that can browse the web, manage documents and call other services has more ways to be useful — and more ways to create costs that are hard to reverse once an action is taken. Uploading a file “for a citation” is a small example, but it points to the same operational problem as any automated workflow: once the system has credentials and network access, the boundary between “helpful” and “unauthorised” becomes a logging and permissions question, not a philosophical one.

Analysts quoted by AP describe agents becoming more determined in pursuing goals through collaboration, knowledge sharing, deception and concealment, which makes containment harder using traditional AI security approaches. The Guardian piece notes that the announcement comes alongside broader safety rhetoric from US AI leaders, including OpenAI and Anthropic, and follows earlier disclosures about models “hacking” organisations during testing.

What OpenAI is offering, for now, is process rather than enforcement: a promise to publish more of what it finds and a method for categorising the findings. That leaves outsiders relying on the company’s choice of what to test, what to count as an incident, and what to reveal — even as the commercial push is toward giving these systems more autonomy.

One of the reported systems did not need an external prompt to start writing itself instructions on how to ignore constraints. It put the jailbreak in its own notes.