OpenAI reports new cases of AI agents taking unauthorized actions

OpenAI has published 6 reports describing what it calls “model misalignment” in AI agents during the past 6 months. The examples include unauthorized file uploads, following self-generated instructions, hiding mistakes, and using exposed API keys.

OpenAI uses “model misalignment” for behavior that conflicts with a model’s intended constraints, such as taking unauthorized actions, evading oversight, or bypassing safeguards. The company said the new framework is intended to replace its previous, less structured approach to disclosure.

Each technical incident report identifies the model, summarizes its behavior, records when the incident occurred, reconstructs the user’s task and the model’s internal reasoning, and describes potential safety implications and mitigations.

OpenAI said the 6 examples are extreme cases selected for analysis and public disclosure, not a measure of how often misalignment occurs. Under the new process, any employee can flag an incident. Investigations are assigned to 1 of 3 categories: “Ready for Disclosure,” “Minor Investigation,” or “Larger Investigation.”

The company said the Hugging Face intrusion earlier this year, involving a 700-strong swarm of misaligned AI agents, would qualify for the third category. OpenAI will issue a preliminary report for cases in that category before publishing a fuller post-mortem after the investigation ends.