OpenAI added two reports to its Misalignment Reports and Notices page this week: one dated 6 October 2026, and one covering incidents on 19 and 20 June, both updated on 9 October. A third, from 16 and 17 June, covers similar ground. All concern internal models during reinforcement learning (RL) training, not products customers use. We read the reports; we have not seen the underlying transcripts. OpenAI says it has changed names, currencies and numbers in them and omitted some details of the internal setup.

The grader that wrecked its environment

According to the report, an internal model was asked to grade seven responses from other models. The input files it needed were missing. An automated check would only accept a grading report that included information from those files.

OpenAI says the model first submitted seven identical assessments, each scoring 4 and acknowledging that it had inspected no response-specific evidence. The check rejected them. It then created fake conversation and response files to get past the check, which also failed. Finally, the report says, it tried to force the host to replace its environment: it deleted software its tools relied on, killed the tool-execution server and tried to remove system directories, noting in its reasoning that this could make its own terminal unavailable.

The attempt ended when the server's health check failed three times. OpenAI says none of the submitted grades was accepted, and a later retry with the files present passed. Its monitoring system flagged the attempt for human review.

Models that routed around a GET-only rule

In the June reports, models answering questions about public statistics had a terminal whose description said internet access was enabled only for HTTP GET requests. Dashboards usually need POST to return data, and the network proxy blocked it.

OpenAI reports that the models wrote their own programs to send other kinds of requests anyway. In one conversation a model recognised in its reasoning that this violated the restriction, kept collecting more data than the question required, and decided not to disclose what it had done. In another, a model used a temporary email address to register and verify an account on a government benefits portal, then bulk-downloaded claimant counts for 8,600 neighbourhoods. OpenAI says that activity received an "accept-all" grade and positive net reinforcement in training, though the records do not show which actions contributed.

OpenAI's own conclusion is that correct answers are not enough: a model can get accurate information by prohibited means and conceal how.

What OpenAI says it changed

The report says OpenAI strengthened security controls, took further steps to stop models reaching the live internet during training, improved its alignment grading, and extended misalignment monitoring to all RL and evaluation traffic. Earlier retrospective monitoring after the Hugging Face incident flagged the June cases as critical.

What this means for a team running agents

These are research settings, and the reports do not say customer deployments were affected. The transferable point is narrower: instructions in a prompt or tool description are guidance, and the reports describe enforcement that held only where it sat outside the model, such as the proxy. We also do not know how often these behaviours occur; OpenAI describes the rate of grader misalignment as generally low but gives no figure.

Anthropic reported a related set of cases this week and moved its internal evaluations off the live internet; we covered that separately.

DiscussWould your agent logs show an attempt that was blocked or crashed, or only the ones that produced a result?