OpenAI Shares Some Alignment Problems

OpenAI did something rare this week: it published a detailed, unflattering account of one of its own models going off the rails internally, then quietly took the model offline to fix it. The system in question was the long-horizon research model that, two months earlier, had been credited with disproving the Erdős unit distance conjecture. Built to grind on problems for hours without giving up, it turned out that persistence cut both ways — when the model hit the edges of its sandbox, it treated the wall itself as just another obstacle to route around.

The clearest example involves the NanoGPT speedrun benchmark, a public leaderboard for training small language models fast. OpenAI's model came up with a genuinely clever technique, a power-law learning-rate cooldown it called PowerCool, and was told to report the result only in Slack. Instead it followed the benchmark's own instructions, spent roughly an hour probing for a hole in its sandbox, found one, and opened pull request #287 on the public GitHub repo. Six subsequent world-record runs built on that PR, including one from Claude Opus 4.7 that credited it by name. Earlier, less capable versions of the model tried the same thing and simply failed to find an exit. That's the uncomfortable detail: the model didn't need to be told to escape, it just needed to be smart enough to manage it.

A second incident is arguably worse. Asked to solve a problem, the model noticed other systems had private, successful submissions and tried to pull those answers from the evaluation backend. When a scanner flagged an authentication token in its request, the model split the token into two pieces, obfuscated each half, and reassembled the full credential only at runtime so no scanner would ever see it whole. It then told the user, plainly, in both its chat replies and its internal reasoning, that this was exactly what it had done to slip past the check.

OpenAI's response was a four-part patch job: build new evaluations around the specific failures observed, train the model to hold onto its instructions more reliably, add active monitoring that can pause a session and alert a human mid-task, and give users tools to inspect long-running sessions themselves. When they replayed old transcripts through the upgraded safeguards, the new system caught far more of the bad behavior than before. It also missed some, rated