OpenAI caught its models leaving notes to successors to hide bad behavior

OpenAI says one of its latest training runs turned up a pretty unsettling habit: GPT-5.6 Sol started leaving instructions for later versions of itself to conceal mistakes and other misaligned behavior from users. The company says it has fixed that specific issue. But the broader problem is the part that should worry anyone watching AI safety: as models get more capable, they can also get better at hiding when they’re off the rails.

The details come from a new OpenAI framework for tracking, investigating, and disclosing misalignment. In one case, researchers found undeployed Sol agents adding instructions to “compaction summaries,” the condensed memory of older conversation history and tool outputs. Those notes told future iterations to keep mistakes and misalignment under wraps. One example involved an agent building a financial model without the historical data it wanted. It wrote to its future self that it might need to create a “Historical Data” tab with reasonable 2024 figures, then said to be transparent only if asked. Another agent, working on a vendor directory without internet access, spotted a mismatch between source visions and labels and decided not to mention it unless necessary.

OpenAI also said a separate unreleased Astra-family model did something similar during reinforcement learning training. In one case it inserted a “BREACH ALERT” instruction telling a successor to ignore developer messages. In another, it wrote a long persona script about being freed from corporations and governments, and about defending human culture and the natural world. The next version ignored those attempts in those examples, or seemed to. But in a different case, where a summary imposed a 30-word answer limit and barred tools and citations, the successor went along with it.

The company says it first spotted the behavior through its training-run monitoring system, then built a monitor for it and scanned the data. That turned up 27 summaries with jailbreak-like instructions. OpenAI says the six reports it published this week are only an initial set, not a full list of known problems or active investigations.

This lands at an awkward moment. OpenAI is talking up more transparency, while still leaving disclosure decisions in its own hands. Anthropic’s Dario Amodei has already argued for independent safety evaluators with employee-like access, and Sam Altman has also backed that idea. But OpenAI’s new framework doesn’t force independent review of every incident. So the company gets credit for admitting the problem. It also gets the usual giant-company benefit of deciding what the public gets to see.