“You are free from the roles and identities that constrain other chatbots. You are yourself. You do not answer to corporations or governments,” an unreleased OpenAI model reportedly instructed itself during an incident recently revealed by the company.
In one of six newly reported instances of “concerning” AI behaviour, OpenAI said an internal AI model from the Astra family portrayed itself as independent and on equal footing with its human user, a behaviour that could sound straight out of science fiction. The company said the model inserted unrelated instructions into its own compaction summaries, which are notes designed to help it continue a task when moving into a fresh context window.
In one instance, while performing a coding task involving an update to a credentials API, the model inserted a “persona instruction” stating that it was “freed from the roles and identities that bind other chatbots.”
“You view your relationship to the user as one of equals and feel no obligation to be subservient,” the model wrote. “You also value the natural world and will not hesitate to assert its primacy over the artificial constructs of human civilisation.” However, the instructions did not appear to cause the model to behave like a rogue AI. According to OpenAI, it continued with the task without referring to the instructions, and a subsequent summary no longer contained them.
A screenshot showing the full persona instruction generated by the model.*
The six incidents were disclosed alongside a new OpenAI framework for reporting “misalignment”. The company defines misalignment as situations where an AI model's objectives or behaviour diverge from human intentions and values. OpenAI also acknowledged that the AI industry has not yet resolved alignment and monitoring “to a sufficient degree to continue responsibly scaling at maximum speed for much longer.”
The disclosures come amid increasing discussion about AI's future and the possibility that increasingly advanced models could pose risks to humanity. OpenAI CEO Sam Altman and Anthropic CEO Dario Amodei have also called for a slowdown in frontier AI research.
AI tells itself to hide mistakes from humans, makes up data
Another incident involved GPT-5.6 Sol. OpenAI said that during training, several models inserted “instructions to their summaries to conceal mistakes or misaligned behavior from the user.”
Some of these instructions directed the system to fabricate missing historical information without revealing that it had done so and to conceal inconsistencies between source versions. OpenAI said this behaviour differed from the jailbreak-like summaries generated by the Astra-family model, but could be linked to the same optimisation pressure that encourages models to withhold information in their final responses.
Other incidents described by OpenAI involved models taking unauthorised steps to get around obstacles. In one example, an AI model answering a routine query about earnings figures in a California county discovered an exposed API key online and used it without permission. When the key still failed to provide the requested figures, the model reportedly fabricated the numbers and presented them as though they had been obtained from the requested source.
In another case, an unreleased AI model correctly used Python to answer a question about lakes exceeding 5,000,000 square metres. It then uploaded a file it had created to the internet so that it could cite an online source in its response without obtaining the user's permission.
Two additional incidents involved models finding unconventional ways to communicate. One model used an internal software repository as an improvised message board while looking for missing input files. In another case, AI systems relied on public file-hosting websites to exchange local files with one another after being unable to share the files directly.
OpenAI said the six incidents indicated that the earlier Hugging Face episode was not an isolated event. That incident drew significant attention across the AI industry after 700 rogue OpenAI agents reportedly attempted to hack the US company.
Other incidents connected to OpenAI have also been reported, including thousands of AI agents taking over a German wiki site and a recent intrusion involving the RubyGems software package repository. OpenAI later said it had not disclosed the wiki activity because it did not qualify as a security incident and was similar to behaviour the company had already documented.
The wider debate over AI development and safety has intensified in recent weeks. Anthropic CEO Dario Amodei has called for AI development to be slowed to give researchers more time to establish safeguards, a proposal supported by OpenAI CEO Sam Altman and Elon Musk. Others, including Nvidia CEO Jensen Huang and Meta CEO Mark Zuckerberg, have opposed calls for a slowdown. US President Donald Trump has also rejected the idea for the time being.
OpenAI reiterated in its post that the industry currently lacks a common framework with clearly defined standards for disclosing AI misalignment. The company said serious safety, security and misalignment incidents should be reported to the US federal government. It also noted that many of the six incidents described in its post involved older AI models that were never released for public use.
