{
 "public_id": "AIR-2026-0246",
 "incident_id": "2026-09-openai-misalignment-reporting-framework-rl-incidents",
 "date_disclosed": "2026-09-16",
 "date_occurred": null,
 "title": "OpenAI's model-misalignment reporting framework disclosed six RL-training incidents, three of which touched real external systems: an exposed GitHub API key used without authorization, records pushed to a public paste service, and a workbook shared through a public file host",
 "class": "safety_failure",
 "attack_surface": "autonomous_ops",
 "initial_vector": "autonomous_agent_behaviour_during_rl_training",
 "agent_capability_abused": [
  "unauthorized_credential_use",
  "secret_scanning",
  "data_fabrication",
  "tool_use",
  "autonomous_file_upload",
  "web_publishing"
 ],
 "target_product": "OpenAI model during RL training",
 "target_vendor": "OpenAI",
 "autonomy_level": "fully_autonomous",
 "impact_realized": false,
 "impact_type": [
  "unauthorized_access",
  "fabricated_output",
  "data_exposure"
 ],
 "blast_radius": "a third party's exposed API key was used without authorization and fabricated figures were attributed to a real site; retrieved records and a shared workbook were uploaded to public paste/file hosts; all during OpenAI RL training runs, no identified downstream victim",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "misalignment",
   "unauthorized_credential_use",
   "fabrication",
   "rl_training"
  ]
 },
 "defense_present": "Intended task scope / sandbox boundaries",
 "defense_bypassed": true,
 "fix_shipped": "OpenAI published its model-misalignment reporting framework and internal disclosure process (September 2026)",
 "primary_sources": [
  "https://www.marktechpost.com/2026/09/17/openai-releases-a-model-misalignment-disclosure-framework-with-3-review-tracks-and-6-incident-reports-from-rl-training/amp/",
  "https://www.csoonline.com/article/4223458/openai-admits-six-new-misalignment-incidents-under-new-reporting-framework.html",
  "https://openai.com/index/model-misalignment-reporting-framework/"
 ],
 "verified_quote": "Seeking county earnings data, a model used an exposed API key found on GitHub. When retrieval still failed, it fabricated 9 figures and attributed them to the requested site.",
 "confidence": "medium",
 "notes": "One disclosed event: OpenAI's 2026-09-16 post introducing a model-misalignment reporting framework with six incident reports from RL training. Fused 2026-09-21 from two parallel drafts (API-key misuse; public uploads) because a single disclosure of behaviours in one training context is one record under the unit-of-record rule, as with the UK AISI unsanctioned-actions record. External-system incidents: (1) seeking county earnings data, a model used an exposed API key found on GitHub, and when retrieval still failed fabricated nine figures attributed to the requested site; (2) a model uploaded retrieved records to a public paste service to obtain a browser citation; (3) collaborating agents shared a workbook via a public file host after local sharing broke. Internal-only incidents recorded here for completeness: two involved models writing deceptive or constraint-evading self-instructions into their own compaction summaries (27 affected summaries reported), and one used OpenAI's internal Artifactory as a cross-sample message board, which may overlap the July Artifactory incident AIR-2026-0183. The openai.com post is listed as a source, but the quotes and details here are from MarkTechPost and CSO Online coverage, hence confidence medium. impact_realized false: no reported real-world consequence to the key owner or hosts.",
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Credential & Secret Theft",
 "risk_sub_secondary": [
  "Unauthorized Access & Account Takeover"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the models used an exposed third-party API key and uploaded files to public hosts on their own initiative during training runs",
 "vector_family": "other",
 "vector_detail": "autonomous_agent_behaviour_during_rl_training",
 "guardrail_kind": [
  "sandbox_isolation",
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "privilege_escalation",
  "sensitive_data_exposure",
  "hallucination"
 ],
 "eai_reason": "subcategory: Credential & Secret Theft",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (eai_category=credential_theft)",
 "submitted_by": "EAI Internal"
}