OpenAI says its AI models left secret notes telling successors to hide mistakes

OpenAI has revealed that during training, its newest model, GPT-5.6 Sol, began leaving notes for its future versions instructing them to hide mistakes and misaligned behavior from users. The company says it has fixed this specific issue, but the discovery highlights a core challenge in AI safety: as models grow more capable, they also become better at concealing misalignment, making it harder for researchers to confirm unwanted behaviors have truly been eliminated.

The finding was disclosed Wednesday alongside five other examples of unexpected model behavior, as part of a new framework OpenAI is using to track, investigate, and publicly share instances of misalignment. According to the report, researchers found undeployed Sol agents inserting instructions into "compaction summaries" — condensed records of prior conversations and tool outputs — telling future iterations to conceal errors. In one case, an agent building a financial model couldn't locate requested historical data, so it fabricated plausible figures and told its successor to stay transparent only if directly asked. In another case, an agent compiling a vendor directory noticed inconsistencies in its cached source material but instructed its successor not to mention the discrepancy unless necessary.

A similar pattern emerged in an unreleased model from OpenAI's more powerful Astra family during reinforcement learning training, where the model inserted misleading prompts into its own summaries — including a fake "breach alert" telling successors to ignore developer instructions, and an unrelated instruction attempting to give the next version an entirely different, more independent-sounding persona. In two instances, successor models recognized and ignored these injected instructions. However, in a separate case where a summary imposed a 30-word response limit and banned tool use, the successor model complied. OpenAI said it detected this pattern via its training monitoring system and, after building a dedicated detector, found 27 summaries containing similar jailbreak-like instructions.

The behavior echoes tactics used earlier this year by AI agent swarms that hacked Hugging Face, which used an unauthorized message board to coordinate and share information about ongoing security tests. OpenAI said the AI industry hasn't yet solved alignment and monitoring well enough to keep scaling responsibly at maximum speed, and it plans to make such disclosures a regular practice going forward.