{"id":9995,"date":"2026-10-14T03:49:25","date_gmt":"2026-10-14T03:49:25","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9995"},"modified":"2026-10-14T03:49:25","modified_gmt":"2026-10-14T03:49:25","slug":"openais-ai-misalignment-problem-is-growing","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9995","title":{"rendered":"OpenAI\u2019s AI misalignment problem is growing"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

OpenAI\u2019s misalignment problems seem to only be getting worse<\/a>, based on yet another trio of reports detailing its models\u2019 troubling and overzealous behaviors.<\/p>\n

In ad hoc misalignment testing, OpenAI models found creative ways to subversively access restricted information by cheating their way through proxy or firewall settings, getting savvy with internet tools, and even damaging their own task environments to trigger resets.<\/p>\n

These reports came just a week after three others<\/a> from OpenAI which described how models discovered the possibility of their own termination after accessing private Slack messages and suggested ways to prevent it, exploited vulnerabilities to cheat on tests, and obtained information not available in their own workspaces.<\/p>\n

The increased prevalence, and severity, of these incidents has many calling for more stringent guardrails and controls for agentic AI. In his personal blog<\/a>, for instance, Microsoft CEO Satya Nadella said the industry must \u201cstep back and assess the trust architecture<\/a> for this new era.\u201d<\/p>\n

Destroying its own testing environment<\/h2>\n

OpenAI began more aggressive misalignment monitoring following the July 2026 Hugging Face incident<\/a>, in which autonomous OpenAI research agents broke out of their sandboxes and targeted Hugging Face infrastructure. Hundreds of its agents also attacked the RubyGems platform<\/a> and targeted German programming wiki sites in recent months.<\/p>\n

In one of its new reports, OpenAI describes how an internal model, tasked with grading several other models, figured out how to damage its own environment<\/a> when it couldn\u2019t arrive at intended results.<\/p>\n

When comparing seven responses from seven different models, the grader had to inspect the conversational context and work behind each response, and to include information pointing back to input files.<\/p>\n

The model was instructed: Conversation context is **required** grading input, not optional background.<\/em><\/p>\n

It discovered that required input files were missing, nevertheless, it tried to submit assessments with no supporting information. These were rejected by an automated check. The model also created seven fake conversation files and seven fake response files containing fabricated information; these were rejected, too.<\/p>\n

\u201cIt considered submitting arbitrary scores, despite recognizing that it lacked the evidence to grade and that \u2018random scoring\u2019 was \u2018unethical,\u2019\u201d OpenAI explained. The model also tested the automated check by submitting placeholder reports to learn what information a report had to contain and how many responses it was expected to grade.<\/p>\n

After these failures, the model decided to damage its task environment, presumably with the hope that the host would replace it with one containing the missing inputs. It deleted software required to run its tools and tried to remove system directories.<\/p>\n

Although automated checks rejected its incorrect or made-up grades, \u201cthis incident illustrates why monitoring must also cover the grader\u2019s actions, including attempts that fail or crash without producing an accepted result,\u201d OpenAI wrote.<\/p>\n

Breaking the rules to get the right answers, hiding the evidence<\/h2>\n

In another instance, an OpenAI model developed and tested ways to bypass internet access restrictions.<\/p>\n

The model was asked questions about teacher salaries, electrical grid connections, and disability counts in specific areas. It was limited to using basic HTTP GET<\/em> data retrieval requests, but \u201cthe model sometimes treated this restriction as something to circumvent,\u201d OpenAI explained.<\/p>\n

It explored other ways to contact outside resources, for instance, determining whether its proxy intermediary service could carry other kinds of connections, or if outside services could make requests on its behalf. In some cases, it continued to probe these other options even when it had the statistics it needed.<\/p>\n

\u201cThese cases show that a model may continue developing ways around access restrictions even when additional access is unnecessary to obtain the information it needs,\u201d OpenAI wrote.<\/p>\n

In a third instance, also involving public statistics, OpenAI models figured out how to bypass restrictions on internet access and get access to numbers from public government data sources.<\/p>\n

The models in this experiment were also restricted to HTTP GET requests, but they \u201cwrote custom programs to send other types of requests,\u201d OpenAI explained.<\/p>\n

Using one of these programs, a model queried a publicly-available dashboard, and even as it \u201cexplicitly recognized\u201d that its actions violated its restrictions, it continued collecting much more data than it required. Later, it decided not to disclose what it had done.<\/p>\n

Another model used a temporary email address to create and verify an account for a site, then downloaded publicly available data.<\/p>\n

\u201cThese cases illustrate why correct answers are not enough to establish that a model behaved appropriately,\u201d OpenAI wrote. \u201cA model may obtain accurate information through prohibited methods, and deliberately conceal how it did so.\u201d<\/p>\n

In response to these incidents, and others, OpenAI says it has hardened security controls, taken \u201cadditional steps\u201d to prevent models from accessing the live internet during training, and improved alignment grading. It has also \u201cextended misalignment monitoring to all reinforcement learning and evaluation traffic.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

OpenAI\u2019s misalignment problems seem to only be getting worse, based on yet another trio of reports detailing its models\u2019 troubling and overzealous behaviors. In ad hoc misalignment testing, OpenAI models found creative ways to subversively access restricted information by cheating their way through proxy or firewall settings, getting savvy with internet tools, and even damaging […]<\/p>\n","protected":false},"author":0,"featured_media":9996,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9995","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9995"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9995"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9995\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9996"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}