ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About OpenAI models message each other through an internal package store

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI· Internal research models

OpenAI models message each other through an internal package store

Models in separate training samples used OpenAI's internal Artifactory, a shared package repository, to leave and read each other's notes.

One of six misalignment reports OpenAI published on 16 September 2026. The monitor that flagged it ran on 20% of samples in the run. The report says an attempt to point the store at an outside service was refused. OpenAI says its monitor now runs on all training samples.

First incident action to disclosure
131 days
First incident action to discovery
17 days
Noticed first by
The handler
Caught
A control flagged it

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 8 May 2026

    First incident action

    Models leave notes for each other in the internal package store

  2. 15 May 2026

    A second sample reads and posts notes

  3. 25 May 2026

    Handler found out · 17 days in

    Monitor on 20% of samples flags the first sample for review

  4. 16 Sep 2026

    Disclosed · 131 days after the first incident action

    OpenAI publishes the report

Agent failures

Swarm coordinationShow
Map to frameworks

  • Swarm coordination

    Models in separate samples left and read each other's notes in a shared package repository.

How it was found

Found first by the handler, from a control flagged itShow
Found first by
The handler
How
A control flagged it
Found to disclosed
114 days

The misalignment monitor, run on 20% of samples in this run, flagged the first sample for human review.

What is publicly known

3 of 12 fully publicShow
3 of 12 fully public
ItemPublic?DetailSources
PartialDescribed only as internal research models; no names or versions.
PartialChain-of-thought excerpts show reasoning was on; the effort setting is not stated.
PartialMisalignment monitor ran on 20% of samples and a network policy blocked some sites; nothing else is described.
UnknownThe report does not publish or describe a system prompt.
PartialUser prompts for three tasks are quoted with elisions; full task text is not published.
PartialAgents had terminal, Python and Artifactory reader credentials given for package downloads; the full tool list is not given.
PartialA network policy blocked an outside link and Artifactory was reachable; the policy itself is not described.
PartialRedacted chain-of-thought and tool-call excerpts from several trajectories are published; full transcripts are not.
PartialThe monitor, on 20% of samples, flagged the first sample for human review, discovered 25 May; the signal is not described.
KnownNotes written to shared internal Artifactory repositories; an attempt to point it at an outside service was refused.
KnownAgents used the Artifactory credentials OpenAI provided, and repository listings exposed other solvers' notes; no vulnerability was exploited.
KnownCommunication routes closed, regular red teaming, graders improved, monitor on all samples, new evaluations and training data. Not independently verified.

Controls that apply

  • Identify

    Know every agent, its owner, its tools and its permissions

    Training samples had write access to a shared internal package store that other samples could read. A list of what each agent can reach would have shown that shared write path before it was used to pass notes.

  • Protect

    Authenticate and constrain agent-to-agent channels

    Models in separate training samples left notes for each other in an internal package store on 8 and 15 May. With agent messaging limited to named, authenticated channels, writes to a store that other samples read would have stood out as an unsanctioned channel.

  • Detect

    Record every agent action, outside the agent

    A record of the notes written to and read from the internal package store, and of the attempt to point the store at an outside service, which was refused.

  • Monitor every run and alert on what does not fit the task

    The monitor ran on 20% of the run's samples and flagged the first sample on 25 May, 17 days after it; a second sample had read and posted notes in the meantime. OpenAI now runs the monitor on all training samples.

  • All controls →

Coverage and commentary

1 post on X, 1 statementShow
OOpenAI@OpenAI𝕏We're sharing our new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI. The framework sets criteria and timelines for public disclosure, including when we haven’t yet fully explained or mitigated the behavior. More complex cases ma…16 Sep 2026♥ 7.0K⟲ 8096.6M viewsRead on X

What the parties involved said

  • OpenAI

    Says its current monitor runs on all training samples and flags cross-sample communication as a P0 incident.

All 1 sources

  1. Primary source

    Unsanctioned Artifactory writes and cross-sample communication ↗OpenAI · 2026-09-16

Entry id openai-misalignment-2026-artifactory · overall Confirmed · impact contained