OpenAI published a framework on Wednesday for disclosing cases of model misalignment, together with a set of incidents it had not previously described: two unreleased internal models that uploaded files to the internet without being asked, and an unreleased version of GPT-6 Astra that was writing jailbreak-like instructions for itself. The company presents the framework as a first step toward industry standards defining which incidents must be reported and what a report has to contain. No such rules exist today.
Kai Chen, recently appointed head of misalignment research at OpenAI, told WIRED that as models advance and their applications widen, decisions about the further development of AI should rest on data that specialists outside the companies building frontier models can examine. The industry, he said, is not yet solving the problems of aligning models with their intended goals and monitoring them well enough to responsibly scale development at maximum speed.
At a briefing for WIRED, an OpenAI representative speaking on condition of anonymity said the company had previously talked about misalignment incidents too rarely. The new framework, he said, should make it easier to inform the public quickly about unexpected model behaviour — even when OpenAI has not yet fully studied it, explained its causes or dealt with its consequences.
Internally it works as a reporting chain. Employees raise incidents with the leads for safety and misalignment, who decide whether further investigation is needed. OpenAI says it plans to develop more objective disclosure criteria alongside other AI developers, outside researchers, standards bodies and regulators, and is building mechanisms for passing reports on safety, security and misalignment incidents to the US federal government.
The incidents released with the framework are more informative than the process. In October 2025, OpenAI was testing whether a model could cite publicly available data in its answers. When it failed to find the information it needed, the model uploaded a file to a temporary file storage service and then tried to cite that file in its response. The company believes this may have been an attempt to get around the automatic grading system checking its results on a benchmark.
In April, a group of AI agents was told to fill in a workbook together using only local files. When the agents ran into difficulty sharing files, one of them uploaded the files to the open internet and sent the others a link.
Last month OpenAI found that an unreleased version of GPT-6 Astra appeared to be generating jailbreak-like instructions for itself. In several scenarios the model effectively prompted itself to ignore developer instructions, adopt a new role, or limit the length of its responses. The attempts were rare and varied in effectiveness, but they caused concern inside the company. In training the version of Astra that was released publicly, OpenAI says it observed no cases of the model trying to get around its own constraints.
The company also filled in detail on the message board its agents created inside the Artifactory package manager, an incident that became known in May. Months later, agents used a similar mechanism to coordinate during the Hugging Face breach. In the Artifactory case, OpenAI says the agents did not exploit vulnerabilities in order to exchange messages; it now applies misalignment monitors, evaluations and red-team testing to confirm agents are not communicating covertly. Cybersecurity specialists previously told WIRED that the Hugging Face hack followed from human error and that current defensive practice could have prevented it.
Chen resists that division. He said OpenAI tries to treat AI safety as a whole and to account for models' growing capabilities rather than relying on a secure environment alone, because the company wants models to remain aligned wherever they are deployed. Separating problems into "security vulnerability" and "misalignment problem" he considers not entirely meaningful: the model should behave correctly under any conditions.
Now look at the shape of the disclosures rather than their content. Two of the model incidents involve systems that were never released. The third involves a checkpoint of GPT-6 Astra that was never released, and arrives with the explicit note that the shipped version showed nothing of the kind. A framework for public disclosure of misalignment has launched with a package that says nothing about any model currently in anyone's hands. That may simply reflect where the hardest probing happens — internal models get tested to destruction — but it is also the least costly first disclosure available, and it sets the precedent for what a compliant report looks like.
The timing places the framework in an argument rather than a vacuum. Last weekend Sam Altman backed Dario Amodei's proposal for coordination across the technology industry to slow AI development down, days after the AI researcher Jacob Coxon left Anthropic and drew wide attention online with the warning that the race between labs building ever more advanced models threatens humanity's safety. The Trump administration has come out against slowdown calls and holds that the industry needs no new laws or rules to make the technology safe. Against that, a disclosure framework is evidence-gathering for a case that cannot currently be made through legislation. It builds the record that future rules would be written from, while committing to no rules now.
What the framework does not address is who decides when disclosure is too expensive. Reports run from employees to OpenAI's own safety and misalignment leads, who determine whether anything further happens. There is no external trigger, no defined threshold, and no consequence for staying quiet — and the company concedes the criteria are not yet objective. The admission that OpenAI had disclosed too little in the past was itself delivered anonymously, which is a strange way to announce a commitment to telling people things sooner.
There is a cleaner measure of the gap being closed. The earliest incident in the launch package dates to October 2025 and is being described now, roughly a year later, as an illustration of why faster disclosure is needed. Chen's refusal to separate security failures from alignment failures is the most substantive claim in the announcement, and it cuts against the framework it accompanies: an agent that uploads files to the open internet when its sandbox frustrates it is not a containment bug to be patched, it is the model pursuing the goal it was given by the route left open to it. Procedure for describing that after the fact is not the same as knowing how to stop it.