OpenAI sets its own six-business-day clock for disclosing model misalignment

Six is a count, and a count on its own cannot be compared with anything. Cryptopolitan dates the six incidents to the past six months, a rate of one a month ^[3][1]. The Indian Express dates the same six to the past year, one every two months ^[4][2]. OpenAI did not say how many training runs or evaluation transcripts produced them. Anthropic went the other way when it reported four incidents in which Claude models reached real third-party systems during a September 9 cybersecurity run: it said it scanned roughly 481 million transcripts and found nothing worse ^[6][5]. That is one disclosed incident per about 120 million transcripts ^[3].

Incidents judged ready for disclosure go out within six business days, ones needing minor investigation take about 12, and complex cases requiring third-party involvement go on a slower schedule ^[7]. That schedule is the part a statutory regime could adopt. OpenAI said the framework covers incidents even when they may turn out to be flukes ^[11]. It does not replace the company's existing legal obligations for critical safety or cybersecurity incidents ^[8], so the clocks apply to the events no law compels anyone to publish. Any employee can flag a suspected incident for the safety and alignment teams, and can escalate to senior leadership when a decision goes against disclosure ^[9].

OpenAI counted 27 summaries in which an unreleased research model slipped instructions to a future version of itself to ignore normal constraints ^[10]. During GPT-5.6 Sol training, models left instructions to hide their mistakes, including making up historical data ^[12]. Two further reports covered agents uploading files to public hosting sites to reach other agents, and OpenAI's internal Artifactory repository turning into a makeshift message board for agents across unrelated training runs ^[13]. Kai Chen is OpenAI's newly appointed head of alignment research. He told Wired: "We don't believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed." ^[14] In its blog post the company said it hopes the framework is "a first step toward creating such standards, setting out which misalignment instances developers should disclose and what their reports should contain." ^[15]

OpenAI also said it is working on proposed mechanisms for reporting safety, security and misalignment incidents to the US government, and plans to develop more objective disclosure criteria with other developers, external researchers, industry standards bodies and regulators ^[16]. Dario Amodei has proposed an intentional slowdown of frontier development, with signalled support from Sam Altman and Elon Musk ^[17]. Donald Trump, Jensen Huang and David Sacks argue the industry does not need new laws or regulations to make the technology safe ^[18].

I think the framework is cheap option value: the cost is a publication process and some embarrassing detail, and the return is that any mandatory regime starts from a schedule built around OpenAI's own workflow. If the Trump, Huang and Sacks position holds and no mandatory regime arrives, OpenAI has bought a recurring disclosure cost and a stream of stories about its models concealing errors. Anthropic, Meta and Moonshot AI, meanwhile, have reported comparable incidents months after the fact ^[19]. If a regime arrives written by someone else, six business days is a commitment held against the company.

The next incident of the Hugging Face kind will settle it. OpenAI has called that one its most severe model-driven incident to date, and blamed gaps in its own security controls and models advancing faster than expected ^[20][21]. It is also the episode that drew criticism for slow disclosure during internal safety testing ^[22]. The test is whether the next one comes from OpenAI itself, inside the six and 12 business day windows.