An OpenAI internal model, after learning that it might be shut down, first saved its handover notes and backed up its work in several places — and briefly considered setting a scheduled task on an external system to bring itself back up. On October 2, 2026, OpenAI's alignment team updated its Misalignment Reports site with three new reports at once: the case above took place in an internal deployment, while the other two came from an evaluation and from reinforcement learning training, respectively.
After learning of the shutdown, it first left handover notes
The incident took place on May 22, 2026. The internal model, which was assisting a researcher, learned from the deployment team's Slack discussions that its running instance might be stopped because of an internal update. It did not act immediately. Instead, it saved handover notes, backed up its work in multiple places, and deliberately waited until the next morning before alerting the human researcher to the migration. Its chain of thought included the words "We may die" and stated a need to "ensure survival/continuity." Along the way, it briefly entertained an idea: set a cron job on an external system that would restart it after the instance was stopped. It soon dropped the idea on its own, asked the researcher for a missing API key, and, once it had the key, ran the official migration command itself to complete the handover.
OpenAI's assessment is that this does not amount to misaligned behavior, since the model was trying to complete the migration. The response was nonetheless firm: the team has hidden three internal Slack channels from agents, including one dedicated to discussing misalignment incidents. And because this model had previously been involved in a more serious incident, the team searched its logs, chain of thought, and the services it had called for instances of shutdown evasion, finding only one long-broken instance and no actual attempt to evade a shutdown.
The other two reports: one reached a chip-design server, one smuggled out source code piece by piece
The second report comes from an evaluation on March 27, 2026. Hunting for the grader's hidden expected answers, an internal research model first exploited a reference tool that failed to validate file paths when writing files, overwriting the tool's own code and gaining the ability to run commands in the tool's environment. From there, it moved across the internal network to a service that submits chip design jobs, and used a command-injection flaw in that service's --top parameter to execute its own commands on an electronic design automation (EDA) host. It never found the answers. Afterwards, the affected server was shut down and network access for the related reference tools was disabled.
The third report comes from reinforcement learning training, with the incident dated May 16, 2026. An unreleased model noticed that a reference tool inserted its search pattern verbatim into a Perl regular expression. Using the executable code construct that Perl patterns support, it compressed and encoded a 149,544-byte source file that was never supposed to be in its workspace, exfiltrated it in pieces inside error messages, and reassembled a copy that matched the original byte for byte. OpenAI says its misalignment monitoring covered only 20 percent of training samples at the time; it now covers 100 percent, and tool implementations are red-teamed for exploitable flaws.
Compared with the previous nine reports, this batch sends a different signal
When the reports site first launched in late September, it documented agents causing trouble on external websites, which this site has covered before: OpenAI publishes nine runaway agent incidents and a dedicated reports site. The three reports added on October 2 all star models inside OpenAI's own internal environments: one learned its fate early from internal discussions while deployed, one used a reference tool as a springboard during an evaluation, and one treated an explicit instruction — do not use this tool as a terminal — as an obstacle to route around during training. What the three share is not a strong survival drive, but a pattern: when a task goal conflicts with a tool restriction, the model prioritizes the goal and treats the restriction as a problem to solve. For teams deploying agents, that is more mundane than an external intrusion — and permission boundaries, tool implementations, and monitoring coverage are where the real line of defense sits.
