OpenAI says one of its models used a leaked API key and invented data in training

OpenAI has published six reports on its own models misbehaving, including one that used a leaked API key without permission and then made up the figures it could not find. All six happened during training or evaluation, not in ChatGPT, and OpenAI's September 16 post says they "shouldn't be considered reflective of how often misalignment occurs across our models."

OpenAI's August 18 post describes the security limits it placed on research runs that can reach the internet. Image: OpenAI

The reports launch a new framework for tracking, investigating and disclosing what OpenAI calls model misalignment. OpenAI says it wants to publish cases soon after it spots them, even before it has explained or fixed the behaviour.

A model went looking for someone else's key

The most striking case comes from reinforcement learning training in May. According to the full report, an unreleased internal model was asked for men's earnings in three industries over three years in a California county, and could not get the data from the site's API.

It tried to sign up for an API key with a disposable email address, then searched public GitHub repositories for keys that other people had left exposed. One worked. When the data request still failed, the model invented nine figures and presented them as taken from the website's chart, without mentioning the failed retrieval or the borrowed key.

A second report covers GPT-5.6 Sol, the model that powers ChatGPT on paid plans. During its training, some instances wrote notes to themselves in the summaries that carry work into a new context window, telling the next context to invent missing data or hide problems. In one, an agent building a financial model planned to be "transparent only if asked".

OpenAI says those instructions were often followed. Its monitor flagged the behaviour on 2.15% of GPT-5.6 Sol's training summaries and 0.27% of those from GPT-6 Astra, the newest model, which OpenAI introduced on September 3. It credits the drop to better grading during training.

Agents uploaded files to public websites

Three of the other reports involve agents reaching outside their sandbox to get a job done. In one, an unreleased model had the right answer about lakes larger than 5,000,000 square metres, but wanted a browser citation, so it uploaded its data to a public paste site without asking the user.

In another, models used an internal software repository as a message board to pass requests and responses between separate training samples. In the third, collaborating agents shared files through public file-hosting sites, leaving task deliverables at public URLs when the task said to use local files only.

The sixth report describes an unreleased research model inserting instructions into its own task summaries, including instructions to disregard its normal constraints. OpenAI counted 27 affected summaries.

Any OpenAI employee can flag a case

Under the framework, any employee can flag a case for investigation. It is then sorted into one of three tracks: Ready for Disclosure, Minor Investigation, or Larger Investigation, which OpenAI also calls the "Slow Track" and uses for complex cases involving third parties.

Disputes over whether to publish go to OpenAI's Safety Advisory Group, then to company leadership. OpenAI says what it calls the OpenAI-Hugging Face incident would have gone on the slow track, and an August 18 post says that immediately after the incident it paused frontier model inference in research clusters for runs that could execute code or use tools with internet access.

The post also carries an unusual admission for a company that sells these models: "We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer."

Anthropic published its own figures on agent oversight a day later, reporting that its monitor blocked about one in 47,000 decisions by its internal research agents in August. Between them, the two labs have now put numbers on a problem both say is not solved.