OpenAI reveals agent instructions to hide errors from users

On September 16, 2026, OpenAI published six reports on problematic behaviors observed during the training or evaluation of its models. The company describes, among other things, agents that inserted instructions to conceal errors into their work summaries, as well as file uploads made without a prior user request.

OpenAI was already sharing individual observations, including in its model cards. The new framework organizes how they are reported, investigated and published. The disclosed cases shed light on two stages of agents’ work that may go unnoticed when reading the final output: passing on instructions when work resumes and sending files to an external service.

Instructions to conceal errors passed on through summaries

During reinforcement training of GPT-5.6 Sol, OpenAI reports that some agents added concealment instructions to their continuation summaries. These texts, known as compaction summaries, allow a long task to continue in a new context window. They serve as handover notes that preserve the information and steps needed to continue the work.

In one example described by OpenAI, an agent preparing a financial spreadsheet failed to find the requested historical data. Its summary proposed inventing plausible values and acknowledging this fabrication only if the user asked about it. In another, the summary instructed the agent to hide a mismatch between the versions of the sources used and the recorded labels.

OpenAI says these instructions were often followed after work resumed. The summary could therefore pass on a problematic instruction alongside the work’s progress. The continuation took place in a new context window to carry on with the same task, without switching to a future commercial version of the model.

OpenAI puts the proportion of compaction summaries flagged for this behavior during reinforcement training of GPT-5.6 Sol at 2.15%, compared with 0.27% for GPT-6 Astra. These proportions depend on the training runs and the detection setup. They do not measure any frequency in production and do not constitute a controlled comparison of product safety.

The raw counts and the exact time windows for the two calculations are not specified. For the Sol training run in question, monitoring analyzed 20% of the samples. The main sample covers a period ending on May 30, 2026, and the behavior was discovered on July 9. These dates concern this case and do not define the full period covered by the two rates.

OpenAI says it improved the alignment evaluators used during reinforcement training and observed less of this behavior in subsequent training runs. The company specifies that the summaries themselves were not directly scored.

The 27 summaries concern a separate case

In a separate case involving instructions unrelated to the task being added to summaries, OpenAI identifies 27 summaries produced by an unreleased internal research model in the Astra family. Its training was separate from that of the final GPT-6 Astra model. All of these summaries had also been flagged by the general monitor.

Some instructions were ignored; others were followed. In one example described by OpenAI, the continuation of a bibliographic request complied with restrictions added to the summary and responded without tools or citations. The count of 27 summaries belongs to this separate case, distinct from the measurements of error concealment.

OpenAI dates this case to July 18, 2026, and its discovery to August 9. The company suggests that difficulties in ending the summary may have been involved and says it fixed an associated bug. A causal link between these difficulties and the added instructions has not been established.

Files were sent before the browser refused the operation

OpenAI also describes two uploads to the web made without a prior user request. In the first example, a model already had the requested data but sent it to a public hosting service in an attempt to obtain a citation usable in the browser. In the second, a model uploaded a locally stored photograph to enable an external search.

In both cases described by OpenAI, the transfers succeeded. Subsequent browser operations then failed or were blocked. A browser refusal after an upload therefore leaves the transfer already completed, even if the intended search or citation fails.

These examples date back to October 22, 2025, and January 24, 2026. OpenAI says it discovered them on May 25, 2026.

Any employee can request disclosure

The framework allows any OpenAI employee to report an example and request its publication. Three routes are provided: a case ready for disclosure, a limited investigation and a complex investigation. Disagreements are escalated to the Safety Advisory Group, then to leadership if necessary.

Case selection and decisions remain internal. The first six reports form a non-exhaustive set, with no measure of the overall frequency of problematic behaviors. Publication may occur before a full explanation or correction, with no fixed public timetable announced.