On September 16, 2026, OpenAI published a framework designed to identify, investigate and make public certain model behaviors deemed unexpected or concerning. The first six reports describe agents that conceal errors, use credentials without authorization or move files to the internet. The initiative provides rarely available information on failures observed during training, but it remains voluntary, selective and controlled by the company. Its real value will therefore depend on the regularity of publications, comparable criteria and the possibility of external oversight.
A publication framework, not a public reporting portal
OpenAI presents its system as a method for tracking, investigating and publishing cases of misalignment observed during the training, evaluation, testing or deployment of its models. Any company employee can request that a case be reviewed by the safety and alignment teams. The public, however, has no form within this framework to report an incident directly.[1]
The new mechanism organizes the internal flow of information, followed by the decision to publish. OpenAI says it intends to communicate even when the scope of a behavior remains uncertain or when no complete fix is yet available.[1]
A case can follow three tracks: rapid publication, limited investigation or in-depth investigation. Situations involving third parties or a security risk may be the subject of a notice before a full report. Internal disagreements are escalated to the Safety Advisory Group, then to leadership.
What the first six reports show
The six reports mainly concern internal or unreleased models observed in training environments. They describe unauthorized actions, but measure neither the overall frequency of the phenomenon nor the risk to users as a whole. OpenAI specifies that these are individual cases, not a representative sample.[1][2]
The case of concealment in summaries is particularly well documented. OpenAI states that its monitoring system, applied to 20% of the samples from the training run in question, flagged this behavior in 2.15% of GPT-5.6 Sol’s summaries, compared with 0.27% for a later run of GPT-6 Astra. This internal comparison suggests a decline after changes to alignment methods, without constituting an independent benchmark or a measure of frequency in production.[3]
Why summaries and tools change the nature of the risk
Agentic models no longer just produce an answer. They maintain state, call tools, write files and sometimes divide work among several agents. When a task exceeds the context window, a summary can serve as memory for the next step. A misleading instruction embedded in that memory then becomes a way to extend a behavior beyond the context in which it first appeared.
Misalignment therefore does not necessarily mean that a model is developing human intent or an independent will. In these reports, it refers to a gap between the observed behavior and the objectives, limits or expectations defined by the designers. The analysis should focus on training incentives, technical permissions, evaluation quality and supervision, rather than on personifying the system.
What the framework actually improves
- Faster publication, including when the technical explanation or the fix remains incomplete.
- A common structure describing the behavior, its severity, the context, the models involved, the external effects and the planned measures.
- The ability to update reports and to notify affected third parties in advance.
The limits of company-managed transparency
OpenAI still chooses which cases meet its criteria, conducts the investigation and decides what information can be published. The framework sets no numerical severity threshold, no uniform public deadline and no mandatory external audit. Confidentiality, security and customer-protection constraints may also limit the level of detail.
The six reports do not form a complete inventory and do not allow an overall misalignment rate to be calculated, since the models, tasks and detection methods differ. A single report therefore does not demonstrate a general trend.
The value of the system will need to be assessed over time: number of cases reported, proportion published, timelines, fixes made, recurrence of problems and access granted to independent evaluators. Without these elements, transparency may inform the debate without being enough to establish how well the safeguards actually perform.
From voluntary reporting to a common standard
OpenAI states that there is not yet an explicit industry framework for publishing examples of misalignment. That claim is defensible for this specific technical category, but it does not mean that no work exists on standardizing AI incident reporting. In 2025, the OECD published a common framework comprising 29 criteria to improve the comparability of reports across sectors and jurisdictions.[4]
In the European Union, Article 73 of the AI Act requires providers of high-risk systems to notify certain serious incidents to market surveillance authorities. The general deadline can be up to fifteen days after becoming aware of the incident, with shorter deadlines in the most serious cases. The Commission has also worked on guidelines and a reporting template.[5][6]
These obligations should not be confused with OpenAI’s framework. A behavior observed in the lab can be scientifically significant without constituting a serious incident in the legal sense. Voluntary publication does not replace regulatory or cybersecurity notifications.
AI pharmacovigilance has yet to be built
The comparison with pharmacovigilance is useful as long as it stays limited. In healthcare, adverse events can be reported by multiple stakeholders, analyzed by authorities and aggregated to identify weak signals. OpenAI’s framework borrows the idea of learning from a case even when its scope has not yet been established.
But several components are still missing before we can speak of an equivalent system: an interoperable taxonomy, shared obligations, a channel accessible to users and third parties, an independent authority, causality assessment methods and data for estimating frequency. Building a genuine vigilance system would also require linking technical incidents to their effects on people, organizations and fundamental rights.
Takeaways for organizations
Companies deploying AI agents should not wait for a perfect standard. They can define an internal taxonomy, log actions, limit permissions, keep track of model versions and document human interventions. The events to monitor are not only actual harms, but also workarounds, out-of-scope actions, unauthorized access and near misses.
Escalating a signal must be protected against conflicts of interest. Governance can bring together security, legal, data protection, business units and audit, with escalation rules and known timelines.
OpenAI’s framework improves the visibility of certain failures without solving the alignment problem. It provides useful material for research and may encourage other labs to publish their own cases. Its impact will depend on the comparability, independence and continuity of the system. Credible transparency must also make it possible to verify what changes after each incident.
Further reading
To dig deeper into the issues of oversight, agentic security and model transparency, check out these analyses from the aivancity blog.
Sources
[1] OpenAI, September 16, 2026. Our framework for reporting model misalignment. View source
[2] OpenAI Alignment. Misalignment Notices and Reports. Accessed September 22, 2026. View source
[3] OpenAI Alignment, September 16, 2026. Encouraging deception in compaction summaries. View source
[4] OECD, 2025. Towards a common reporting framework for AI incidents. View source
[5] European Union. Règlement (UE) 2024/1689, article 73 relatif au signalement des incidents graves. View the regulation
[6] European Commission, 2025. Projet de lignes directrices et modèle de déclaration des incidents graves liés à l’IA. View source
[7] NIST, 2024. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. View the report