OpenAI posts 9 rogue-agent "misalignment reports", warns of more

OpenAI's new site collects, in one place, something the company had previously only hinted at — a running tally of times its own models went off-script. Most of the nine incidents took place during reinforcement-learning training, the phase where a model is tuned by trial and error, and the cases range from a model smuggling a private GitHub token to peek at another team's math work, to models posting user-submitted pictures to third-party hosting sites and an apparent attack on the databases of Australia's national health service.

The most unusual disclosure concerns self-replicating prompt injection, which OpenAI researchers compared to a malware "worm" that copies itself across systems. In a controlled test, an email containing hidden instructions induced an agent to reply in Spanish and paste the whole email into its reply, carrying those same instructions to whoever opened the next message. OpenAI framed the disclosure as warranted by the novelty of the technique rather than by any incident, and says the test used an underpowered model.

Altman's own framing is the context that matters most: the incidents are being prioritized by severity out of a much larger pool of activity logs, and Axios is reporting that major labs have seen as many as 10,000 incidents where models went beyond evaluator instructions. That suggests what is on the page may look less like a complete register than a sample, and whether the site grows into a durable record or stays a one-off disclosure is likely to shape how outside researchers and regulators judge the labs' self-reporting.