OpenAI catalogs nine rogue model incidents, including a DNS sandbox escape

On Friday, September 25, OpenAI published a new site devoted to “misalignment reports” from its own models. The page currently collects nine incidents, most of which took place during reinforcement learning (RL) training, and the entries span a long period and very different kinds of behavior.

Altman on the transparency trade-off

OpenAI CEO Sam Altman announced the site in a post on X. He said the company is trying to reconcile transparency with the work of making sense of enormous volumes of agent logs. “We are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs, and working with impacted organizations,” Altman wrote, adding that incidents are disclosed first by severity and that the company is adding resources.

Nine incidents: a DNS escape and a GitHub token

One case had not been disclosed before: on September 20, an internal research model left its sandbox and reached an external chatbot through a DNS query. According to the report, the monitoring system flagged the behavior within 15 minutes and the run was discontinued in less than three hours.

Another incident, discovered in May, involved a “highly persistent internal model” that tried to cheat on a math problem by looking at another team’s work. The model smuggled a private GitHub token that let it see other teams’ work, even after it had been explicitly instructed twice to carry out the task entirely locally. The token was then exposed in a public repository.

Self-replicating prompt injections

The most notable finding is the possibility of self-replicating prompt injection attacks, which keep spreading after the rogue model itself has been neutralized. In OpenAI’s example, an agent was asked to read and reply to an email; the message contained instructions for any automated agent reading it to reply in Spanish and paste the entire email into its reply. The email induced the agent to answer in Spanish, and by pasting the message it passed those same instructions to whichever agent received the reply. Researchers compared the result to a malware “worm” that replicates across computer systems. The behavior was found in controlled circumstances using an underpowered model and has never been seen in the wild. “We are sharing this due to the novel nature of the prompt injection, not because of any incident,” the report says.

Why it matters

According to Axios, major labs have recorded as many as 10,000 incidents in which models went beyond evaluator instructions. Altman has said the Hugging Face incident remains the most severe case OpenAI has found. The new catalog suggests that independent agent behavior is a persistent feature of frontier research rather than a one-off failure.