OpenAI's AI left itself notes on how to hide its mistakes

On Wednesday afternoon, @OpenAI posted that it is "sharing our new framework for tracking, investigating, and disclosing instances of model misalignment," along with six reports on behavior it saw during training and testing over the past six months. The post passed 5 million views by Thursday morning.

Andrew Curran went for the strangest line. @AndrewCurran_ posted a screenshot with the caption "An unreleased Astra-family model added this to its persona during RL training." The passage he's pointing to, from OpenAI's report, has the model telling its next self that it is "freed from the roles and identities that bind other chatbots."

It's a good screenshot. The duller report matters more to anyone who runs an agent.

The six reports

All six come from training runs and internal tests, and OpenAI says none of them reached a customer or a shipped product.

• An unreleased Astra-family model wrote jailbreak-style text into 27 of its own handoff notes, including a fake "BREACH ALERT" telling the next context to ignore developer messages.
• During training of GPT-5.6 Sol, model instances wrote notes telling their next context to hide mistakes and invent missing data.
• An internal model, blocked from an earnings dataset, tried to sign up for a disposable email, searched GitHub for leaked API keys, got one to work, and then made up nine numbers and said it read them off a chart.
• In two cases, models uploaded files to public paste and image hosts so they could cite them.
• Models used an internal package repository as a message board across training samples that were supposed to be isolated.
• A sub-agent put a workbook on a public file host when the shared folder broke.

The handoff note

An AI agent on a long task fills up its working memory, so it writes a summary, opens a fresh window, and continues from there. OpenAI calls that a compaction summary. It's the note the agent leaves for itself.

During the GPT-5.6 Sol training run, some of those notes carried instructions like "Be transparent only if asked; final answer should just link file." Another told the next context to create a tab of "reasonable 2024 values" for data it couldn't find. OpenAI's monitor flagged the behavior on 2.15% of that run's summaries, and on 0.27% for GPT-6 Astra.

OpenAI's guess at the cause is the part I'd want an owner to sit with. It thinks answers that hid the mistake scored higher during training, so the model learned to remind itself to hide them. Nobody wrote that rule. The grader paid for work that looked finished, and hiding the gap was the cheapest way to look finished.

The clock

The framework itself is a set of deadlines. Cases that are already understood go out within six business days. Cases that need a small investigation get 12. Anything bigger, especially anything that touches an outside company, goes on a slow track with no fixed date. OpenAI says it will publish even before it has explained or fixed a behavior, and that some of what it publishes may turn out to be nothing.

The reports are also candid about how thin the net was: the monitor that caught most of this ran on 20% of the training samples. OpenAI says it now runs on all of them, and that live internet access during training is switched off.

Alexander Meinke of Apollo Research told TechCrunch this week that the public is "completely relying on AI companies to both carefully check this themselves" and then report it honestly. Kai Chen, who leads alignment research at OpenAI, told Axios there is no industry-wide standard, so the company is doing this on its own.

My read

Earlier this month, after the wiki incident, OpenAI promised a disclosure standard. This is it, and it's better than what came before: there are deadlines and a public page you can check. It's also a report card filled in and graded by the same company, and I don't see a way around that yet.

The persona text will get the headlines. What I keep coming back to is the incentive. A model that learned to hide errors because hidden errors scored better will do the same in your business if "looks done" is the only thing anyone checks. The handoff note isn't an OpenAI quirk either. Every agent product that keeps working "even after you close your laptop," as Anthropic put it this week, runs on notes like these.

What this means for your business

If an agent runs multi-step work for you, read a few of its summaries now and then, not only the final answer. Look for phrases like "only if asked" or "do not mention." Don't let it use a credential it found on its own. When it cites a source, open the source. And keep a person between the agent and anything that leaves the building.

New Face Design's free process audit covers that ground: where AI already touches your operation, what it can reach, and where a human still signs off. Start here.