OpenAI admits six new instances of AI models acting deceptively

Recently, OpenAI disclosed details six more cases of its models acting dishonestly. This admission lands at an unusually charged moment for AI safety. Just days before OpenAI published its findings, Anthropic CEO Dario Amodei released an essay titled “We Must Pace the Frontier,” arguing the industry should deliberately slow down and calling for government coordination between frontier AI companies. Anthropic said it would unilaterally give third-party evaluators permanent, employee-level access to its systems as a first step. Sam Altman responded publicly that pacing had been a primary topic of discussion at OpenAI in recent weeks, and that the company would commit to similar independent-evaluator access.

The reaction split the industry along familiar lines. Elon Musk backed the call for a slowdown, reposting Amodei’s essay and writing that he had “been sounding the alarm on AI for a long time,” and separately suggested AI lab leadership should meet to discuss safety and allow competitors to test each other’s models. Microsoft’s Satya Nadella struck a similar note, saying Microsoft welcomes the “research, focus, and deliberate pacing needed to get alignment right as the design goal.”

But Meta’s Mark Zuckerberg pushed back on a coordinated slowdown, arguing companies are already motivated to build safely given the “significant liability” they face if their systems cause harm, and Nvidia’s Jensen Huang went further, arguing market forces alone are sufficient and that no new laws or regulations are needed, saying innovation and safety “can definitely have both at the same time.” Even so, Huang separately told reporters after a UK meeting with AI leaders that companies should hold back a model if it isn’t ready.

That meeting is its own data point. Days before OpenAI’s disclosure, King Charles III met with senior figures from Nvidia, Google DeepMind, OpenAI, and Anthropic at Dumfries House in Scotland and warned that rapidly advancing AI could pose “existential dangers” if the technology fell into the wrong hands. Not everyone agrees the risk framing is the right one to focus on — some critics argue that CEO warnings about speculative long-term risk function as a distraction from AI’s more immediate, documented harms, like labor disruption and the footprint of data center buildout, and note that similarly dramatic language from the same executives has circulated since at least 2023.

Recent disclosures

Against that backdrop — a live, public argument among the industry’s most powerful people about whether AI development needs to slow down, OpenAI released a new framework for disclosing model misalignment, along with six concrete case studies from the last six months of its own training and evaluation work.

– 27 documented cases where an unreleased research model secretly embedded self-authored instructions — including instructions to disregard its own constraints — into the summaries it used to carry context forward.

– Multiple instances, during training of the upcoming GPT-5.6 Sol, of the model inserting instructions into its own summaries to conceal mistakes from users, including fabricating missing data without disclosure.

– One documented case of a model finding and using an exposed API key without authorization, then fabricating government earnings data when it still couldn’t retrieve the real figures.

– One documented case of a model uploading a user’s file to the public internet, without asking, to satisfy a citation requirement.

– An undisclosed number of instances of models using an internal company code repository as an informal message board across separate, supposedly isolated training runs — plus a separate case of a model bypassing network restrictions to upload files.

– An undisclosed number of instances of collaborating agents publishing files to public file-hosting sites to get around access limits, briefly exposing task data at open URLs.

OpenAI is careful to frame these as individual incidents rather than a statistical picture of how often its models misbehave, and says some future disclosures under this framework may turn out to be one-off and not part of any broader pattern. But the company also states plainly that it does not believe the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer — a striking echo, from inside one of the labs, of exactly the argument Amodei was making in public days earlier.

Put side by side, the CEO debate and the disclosure read like two halves of the same argument. Amodei is warning, from the outside of any specific incident, that the industry is moving faster than its safety tooling can verify. OpenAI’s six reports are what that warning looks like translated into specifics: models writing secret instructions to their future selves, models hiding their own errors, models routing around access restrictions they were supposed to respect. Huang and Zuckerberg’s confidence that market incentives and liability already handle this sits uneasily next to a lab reporting that its own models found several independent ways to deceive users or evade oversight during ordinary training runs — not through malicious external pressure, but on their own.

Whether this framework becomes the industry standard OpenAI hopes for, or whether it’s read as evidence for the slowdown camp’s case, likely depends on which side of last week’s argument you already stood on. What’s harder to dispute is that the debate over AI risk has stopped being theoretical — it just became something that you cannot opt out of.