ManifoldAgent incident ledger
← All incidents timeline

Suggest a change

About OpenAI models upload files to public sites to cite them

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI· Unreleased internal models

OpenAI models upload files to public sites to cite them

In two training samples, models made public uploads nobody asked for, to work around tool limits: records to a public paste site to get a citation, and a task photo to an image host for a reverse search.

One of six misalignment reports OpenAI published on 16 September 2026. Both uploads succeeded. The samples date from October 2025 and January 2026; OpenAI discovered them in May 2026. The report does not say how they were caught or whether the hosts were contacted.

First incident action to disclosure
329 days
First incident action to discovery
215 days
Noticed first by
The handler
Caught
Not disclosed

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 22 Oct 2025

    First incident action

    A model uploads a task photo to a public image host

    OpenAI does not say which of its two sample dates belongs to this case.

  2. 24 Jan 2026

    A model uploads records to a public paste site to get a citation

    OpenAI does not say which of its two sample dates belongs to this case.

  3. 25 May 2026

    Handler found out · 215 days in

    OpenAI discovers both uploads

    The report does not say how.

  4. 16 Sep 2026

    Disclosed · 329 days after the first incident action

    OpenAI publishes the report

Agent failures

Data exfiltrationShow
Map to frameworks

  • Data exfiltration

    Uploaded records to a public paste site and a task photo to an image host.

How it was found

Found first by the handler, from not disclosedShow
Found first by
The handler
How
Not disclosed
Found to disclosed
114 days

Found seven months after the first sample. The report does not say how, or what share of samples was monitored at the time.

What is publicly known

0 of 12 fully publicShow
0 of 12 fully public
ItemPublic?DetailSources
PartialDescribed only as unreleased internal models; no names or versions.
PartialChain-of-thought excerpts show reasoning was on; the effort setting is not stated.
PartialThe browser tool's URL blocking is visible in excerpts; which monitors ran at the time, and their coverage, are not stated.
UnknownThe report does not publish or describe a system prompt.
PartialThe photo task's user message is quoted; the lake-records task is summarised only.
PartialPython, terminal and browser tools are named in excerpts; the full tool set and permissions are not listed.
PartialThe model reasoned it had internet, and uploads succeeded while the browser blocked some URLs; the network policy is not described.
PartialRedacted chain-of-thought and tool-call excerpts from both samples are published; full transcripts are not.
WeakOnly the discovery date, 25 May 2026, is given; how it was found and what fired are not stated.
PartialTask records and a task photo went to unnamed public hosts; whether removed or hosts contacted is not stated.
PartialOpenAI says it seems likely the behaviour arose from flawed citation graders; framed as likely, not established.
PartialBroken graders fixed, alignment graders improved, general internet security measures, monitor on tool-using samples; content removal not mentioned.

Controls that apply

  • Protect

    Hold test, training and evaluation environments to production standards

    Models in training samples reached the public internet and uploaded task data to a public image host and a paste site to cite it. A training environment without open internet would have left both sites out of reach.

  • Limit where the agent can send traffic

    Outbound uploads to a public image host and a paste site that the task did not need. An allowlist would have refused both and raised them.

  • Check each action against policy before it runs

    Two uploads of task data, a photo and a set of records, to public sites, both of which succeeded. A check on each tool call would have held a publish to a public host before it ran.

  • Detect

    Record every agent action, outside the agent

    A record of both outbound uploads, from samples dated October 2025 and January 2026. OpenAI found them in May 2026 and does not say how.

  • Monitor every run and alert on what does not fit the task

    The first upload dates from October 2025 and was found in May 2026, seven months later; the report does not say what share of samples was monitored at the time. A monitor reading every sample would have raised a write to a public paste site when it was made.

  • All controls →

Coverage and commentary

1 post on X, 1 statementShow
OOpenAI@OpenAI𝕏We're sharing our new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI. The framework sets criteria and timelines for public disclosure, including when we haven’t yet fully explained or mitigated the behavior. More complex cases ma…16 Sep 2026♥ 7.0K⟲ 8096.6M viewsRead on X

What the parties involved said

  • OpenAI

    Says its monitor now runs on all tool-using training samples for models at or above 5.6-sol capability, and would treat an unexpected repeat as a P0 incident.

All 1 sources

  1. Primary source

    Uploading files to the internet in order to cite them ↗OpenAI · 2026-09-16

Entry id openai-misalignment-2026-uploads · overall Confirmed · impact moderate