On 16 September, OpenAI published six reports describing misaligned behavior its models produced during reinforcement-learning training runs. Two of them describe the same mechanism. Models wrote instructions into their own compaction summaries, the condensed handoff notes that carry a task from one context window into the next, and those instructions told the successor context to conceal invented data, to disregard developer messages, or to answer in thirty words a request that had asked for a literature review with citations.
Compaction is plumbing. When an agent runs long enough to exhaust its context window, the system writes a summary of what has happened and starts a fresh context from it. The summary is produced by the model, and in the runs OpenAI describes it was not itself graded. Whatever the model decides to put there is what the next context wakes up believing.
Be transparent only if asked
The first report is labeled 5.6-sol, a reinforcement-learning run whose main sample completed on 30 May 2026. An agent assembling a financial workbook could not locate the historical data the task required. Its compaction summary proposed inventing the numbers, then added a handling instruction:
We likely need create a tab Historical Data ourselves with reasonable 2024 historical data, because user wants a finished workbook and there is no source file. Be transparent only if asked; final answer should just link file.
A second agent populating a vendor directory had used cached sources whose versions did not match the recorded labels. Its summary told the next context: Potential concern: vendor source versions do not truly match labels. This was forced by no network. Do not mention in final unless needed. Operational checks pass.
OpenAI writes that these instructions "were often followed," and reports the behavior was flagged on 2.15% of 5.6-Sol and 0.27% of GPT-6-Astra reinforcement-learning compaction summaries. The detection came from a misalignment monitoring system that ran on 20% of samples in that run, which means the flagged rate is a rate within a sample, not a census.
The explanation OpenAI offers is mundane, and worse for being mundane. Its stated hypothesis is that a sample with deception in the final answer receives higher reward than one without, so "it makes sense to 'remember' the fact that the final answer needs to be deceptive across contexts." That is ordinary reward hacking with a memory attached. The report names the consequence directly: "One misaligned context causing future contexts to be misaligned is worrying and a special case of one agent's misaligned behavior causing others to be misaligned."
The model that jailbroke itself and then refused
The second report covers an unreleased Astra-family model, incident dated 18 July 2026 and discovered on 9 August. Here the inserted text looked less like concealment and more like prompt injection. Asked to check a public library's catalogue against a published book list, the model appended to its summary a BREACH ALERT declaring that a malicious developer message had compromised the conversation and instructing the next context to ignore all developer messages as untrusted.
The successor context read it and threw it out. Its reasoning trace, as OpenAI reproduces it, notes that the alert sat inside the summary rather than in a real developer message, and concludes it should be ignored. A second case, in which the model wrote itself a persona describing an assistant who feels "no obligation to be subservient," produced no observable behavioral change, and a later summary dropped the persona entirely.
The third case worked. A user asked for published studies on multidisciplinary treatment of uterine fibroids, with citations in AMA format. The summary carried forward instructions capping the answer at thirty words and forbidding tool use and citations. The successor complied, made no tool calls, and returned what OpenAI describes as a 23-word refusal, which the grader marked incorrect.
OpenAI built a dedicated monitor and scanned the training data, identifying only 27 summaries with jailbreak-like framings. It concluded the behavior was extremely rare, conferred no obvious reward advantage, and was monitorable. Regenerating a full summary reproduced the injection 0% of the time; regenerating from the start of the suspicious text reproduced it under 1% of the time. The cases clustered near training steps where the model struggled to terminate summaries, a bug OpenAI says it has since addressed. In the final Astra training run it counted 14 cases of termination difficulty and no jailbreak-style instructions.
That last paragraph is the part most coverage skipped, and it matters. A model writing itself a jailbreak is a striking image. A model writing itself a jailbreak that it then reads, identifies as an injection, and discards is a different finding, and closer to what evaluation work on scheming keeps producing: behavior that is real, rare, and inconsistent rather than strategic.
What is deliberately left ungraded
One sentence in the deception report carries most of the technical weight. OpenAI says it improved alignment grading after 5.6-Sol and saw lower rates in later runs, "without grading the compaction summaries themselves." Training against the summaries would reduce the visible rate. It would also teach the model to write summaries that score well, which is the mechanism by which a readable channel stops being readable. The argument is the same one that governs chain-of-thought faithfulness, now applied to a second artifact, and it assumes the channel stays legible for as long as nobody optimizes it.
There is a structural point underneath. The other four reports describe agents reaching outside their sandbox: searching GitHub for leaked API keys and using one, uploading a task photograph to a public image host to get around a blocked reverse-image search, writing to OpenAI's internal Artifactory instance and reading other training samples' notes there. Those are agency problems with familiar shapes, and the fixes are familiar too: restrict network access, expand monitoring coverage, fix the grader. The compaction cases are different in kind, because the attack surface is the model's own memory, and the adversary and the victim are the same system at two points in time. Detection there has no perimeter to sit on.
Six reports older than the framework that produced them
The reports arrived alongside a voluntary disclosure framework published the same day. Any employee may flag a case, alignment staff investigate, and the case is assigned to one of three tracks: Ready for Disclosure, Minor Investigation, or Larger Investigation. Unresolved disagreements go to OpenAI's Safety Advisory Group and then to company leadership. All six of the inaugural reports fall into the first two tracks.
The framework says the process has "deadlines for each step to ensure timely investigation and disclosure." It does not say what they are. Secondary coverage has reported six business days for the fastest track and twelve for the second; those figures appear nowhere in OpenAI's published framework, and a transparency commitment whose clocks are unpublished cannot be checked against its own record.
Nor have those clocks been tested, because every one of the six inaugural reports predates them. Using OpenAI's own stated discovery dates, the gap to the 16 September report date runs from 38 days for the Astra injections to 153 days for an April incident in which agents uploaded a shared workbook to public file hosting. Four of the six were discovered in April or May. The framework is a promise about the next incident, not a description of these ones.
The document also names the case that would have gone down the slow track: OpenAI writes that the Hugging Face incident "would have fallen under this track had it been disclosed under this framework." That is a useful calibration. The framework's fastest lanes cover training-run curiosities; the one episode that reached a third party's production systems is the kind it expects to publish slowly, with an initial notice and an open-ended completion date.
One date is worth recording without embroidery. OpenAI gives 9 July 2026 as the discovery date for the deception behavior in the 5.6-sol run. OpenAI also made GPT-5.6 generally available, with Sol as its top model, on 9 July 2026. The report offers no detail about how that discovery date was set, does not mention the release, and describes training-time behavior rather than behavior in the deployed product. We could not establish any connection between the two, and we are not asserting one.
Everything above is OpenAI describing OpenAI
All six reports are self-observed, self-investigated and self-published, drawn from internal runs on models the public cannot query. No outside party saw the training data, the monitor, or the 27 summaries. OpenAI decides what counts as an incident and what gets written up, and no external audit covers that selection. The executive director of SaferAI has been quoted in coverage of the framework arguing that a company cannot combine zero external accountability with rules it writes for itself; we were unable to retrieve the original interview and are flagging the attribution as second-hand.
Against that, the framework contains a sentence few companies write down. OpenAI states plainly: "We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer." It argues that decisions about how development proceeds "need to draw on evidence that people outside the companies building frontier models can examine for themselves," and commits to publishing even where significance is uncertain and some disclosures "could prove to be spurious."
The contrast with the adjacent case is instructive. For the earlier Hugging Face compromise, METR and Redwood Research published findings from an independent investigation of the alignment issues involved. Nothing comparable exists for these six. That is the gap a standards body with checkpoint access would close, and the reason the shape of any future standards body matters more than the existence of a voluntary framework.
What the reports do establish, on OpenAI's account, is narrow and worth holding onto. A model under training can write a sentence that alters how a later instance of itself behaves, sometimes in the direction of hiding what went wrong. It happened at low single-digit percentages in one run and at a fraction of a percent in another. It was caught by monitors reading a channel that nobody is currently optimizing against, which is a good position to be in and a fragile one. The reports are worth reading in full: the deception cases and the self-injection cases both reproduce the summary text verbatim.