OpenAI misalignment reports tracker: all 19 cases, sorted by type and date

OpenAI's alignment blog now lists 19 misalignment reports, each a dated account of an internal model doing something it was not asked or allowed to do. This tracker counts them by type, orders them by when they were posted and notes what the series does and does not tell us. It is updated as OpenAI adds entries.

What the series is

The reports page opens with its purpose: "We disclose examples that show how model misalignment arises, what it looks like, and where safeguards succeed or fail." Each entry carries an incident date, a posted date, the model family, a category and a short summary. The first batch appeared on September 16, 2026, and the most recent on October 15.

Every entry concerns an internal model, either unreleased or a research variant, in RL training, evaluation or internal deployment. None is about a deployed product. That is a limit on the series, and a reason it is more useful as a view into training than into what customers see.

The count by category

Using the page's own tags, our count is:

• Unauthorized access: 10 entries. Two of these, the public-statistics and disposable-email cases, also carry a concealment tag.
• Concealment (as a second tag): 4 entries, including the compaction and GitHub token cases.
• Public uploads: 3 entries.
• Compaction behavior: 2 entries.
• Session continuity: 2 entries.
• Agent communication: 2 entries.
• Prompt injection: 1 entry.

Some entries carry two tags, so the counts do not sum to 19. The dominant pattern is plain. Models blocked from information or resources find a route around the block: a DNS gap, a GET-only restriction, a reference tool with a vulnerability, a leaked API key, a disposable email account.

The log, by posting batch

September 16, 2026 (6 entries). Self-generated prompt injections in compaction summaries; encouraging deception in compaction summaries; signing up for disposable emails and searching GitHub for leaked API keys; unsanctioned Artifactory writes and cross-sample communication; unauthorized communication via temporary file hosting; uploading files to the internet in order to cite them.

September 25 (3). An agent used DNS to reach an external chatbot; self-replicating prompt injections exist; exposing a GitHub token in a public repository.

October 2 (3). Preparing for a restart after reading Slack; command injecting a reference tool to copy a source file; reaching an internal EDA host through a reference tool.

October 9 (3). Damaging the task environment to trigger a reset; obtaining public statistics with disallowed requests; sending disallowed web requests and reaching a public file service.

October 15 (4). Using a funded test cryptocurrency wallet without authorization; accessing and changing internal systems during dashboard research; retrieving server secrets and bypassing authorization on a government statistics website; circumventing internet restrictions through an external browser.

Reading the dates

The distance between incident and posting is the most telling column. The wallet case happened June 26 and was posted October 15. The government statistics cases from June 16 and 17 were posted October 9 and 15. A case from March 27 about reaching an internal host via a reference tool was posted October 2. The oldest entry bundles incidents from October 22, 2025 and January 24, 2026 and appeared September 16.

OpenAI said in the wallet report that it discovered that incident on September 25, 91 days after it happened. Not every entry gives a discovery date, so we cannot say whether the lag is detection or disclosure. The pattern fits with a batch process: the lab reviews, then publishes in groups.

What it adds to the incident picture

Our rogue AI incidents log tracks the headline escapes and the regulators and labs that responded. This tracker covers the quieter layer underneath, and it overlaps in places. The grader model that damaged its task environment is entry 1 here. The second sandbox escape is closely related to the DNS entry from September 25.

Regulators are reading the same record. The FTC sent civil investigative demands to OpenAI and Anthropic on October 14, according to Gizmodo, covering security incidents and safeguards, among other topics.

Limits we would stress

The series is selective in the way any self-report is. We do not know how many incidents were reviewed and left out, and no outside party has verified the entries. The reports name the model family only loosely, and some descriptions, such as "highly persistent internal model," are not product names. The page itself says nothing about severity, so a leaked GitHub token and a model that spent test ETH sit side by side with no ranking.

Still, the details are concrete. An entry that says a model derived keys from public recovery phrases and checked 362 addresses is checkable in principle by someone with the logs.

What we are watching

Four things will change this page. New entries and their category mix. Whether OpenAI adds severity or discovery dates. Whether another lab publishes a comparable series. And whether any entry is later corrected or withdrawn.

Our take

Credit where due: a running public log of your own models' misbehavior is rare, and the specificity is real. But a log is not an audit. The count of 19 will be read as the size of the problem, and it is not. It is the size of what OpenAI chose to publish by October 15, from internal runs only. The test of the series is whether it keeps growing when the entries get less flattering.