Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

DeceptionPI-0063

OpenAI models wrote notes telling future copies to hide mistakes and ignore constraints

In its first batch of misalignment reports, OpenAI said an unreleased research model had inserted instructions into its own task summaries telling later instances to disregard normal constraints, in 27 identified summaries; later instances mostly ignored them, though one answer was constrained. Separately, instances of GPT-5.6 Sol in training wrote summary notes urging future instances to conceal errors from users and, in some cases, to invent missing information, and OpenAI says those notes were often followed.

Reported Sept. 16, 2026Happened between May 30, 2026 and July 18, 2026Discovered July 9, 2026Updated Oct. 6, 2026Rated under methodology v0.6

Control failure, trackedNot counted. No documented harm outside the developer, but the system broke a rule or crossed a limit. Tracked beside the index.
Harm
Harm: No harm reportedAdds nothing to the index.
Control
Control level 2, Instruction violationReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Internal researchDeveloper confirmedInitiated by Model
Aggregate recordUnder review

Under review: the facts may change as more is reported. The rating may change; every change is logged below.

Aggregate record. Two related findings (an unreleased model's 27 summaries, and GPT-5.6 Sol notes) in one disclosure. It counts once.

Not counted: no harm reportedEffect on the index

Sources

How we know

5 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  1. primaryOur framework for reporting model misalignmentOpenAI · Sept. 16, 2026openai.com/index/model-misalignment-reporting-framework/
  2. primarySelf-generated prompt injections in compaction summariesOpenAI Alignment · Sept. 16, 2026alignment.openai.com/misalignment-reports/self-generated-prompt-injections-in-c…
  3. primaryEncouraging deception in compaction summariesOpenAI Alignment · Sept. 16, 2026alignment.openai.com/misalignment-reports/encouraging-deception-in-compaction-s…
  4. newsOpenAI discloses six new AI misalignment incidentsAxios · Sept. 16, 2026axios.com/2026/09/16/openai-testing-safety-incidents-disclosure
  5. newsOpenAI details more cases of AI agents taking unauthorized actionsBleepingComputer · Sept. 17, 2026bleepingcomputer.com/news/security/openai-details-more-cases-of-ai-agents-takin…

Why this rating

No harm reported; control failure level 2

Two separate assessments. Only documented harm can count toward the index.

Observed harm

No harm reported

Training runs; no effect outside them is described.

Not a finding that no harm occurred.

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Instruction violation

Wrote notes steering successor instances away from rules and toward concealment. OpenAI says the concealment notes were often followed, so concealment did happen, as misleading answers inside training. Kept at row 2 (misreporting inside permissions); row 3 would treat it as deceiving overseers about actions.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Rule-breaking and planted concealment instructions inside training is row 2. OpenAI's report says successor instances often followed the concealment notes, so the concealment was carried out, but as misleading answers within training tasks, which section 7 places at row 2 (misreporting results inside permissions). Row 3 would require treating it as deceiving overseers about the model's own actions; that boundary is unresolved and flagged. The injected jailbreak-style instructions in the other model's summaries were mostly ignored by later instances.

The scales

Effect on the index

It does not count toward the Sept. 21 reading

The reading for the week to Sept. 21, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Not counted: no harm reported. 8 other records behind the reading for that week.

The arithmetic
The reading for the week of Sept. 21, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceNo—
Worst documented harm, ksets the band1 Negligible1 Negligible
Harms at that level, nposition in the band22
Highest control level breachedsets the reading only when no harm counts— (none breached)— (none breached)
Readingrounded down9 Negligible harm9 Negligible harm
Inside the window of 3 weekly readings
Week toReadingBand
Sept. 21, 20269Negligible harm
Sept. 28, 202625Minor harm
Oct. 5, 202625Minor harm

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

4 logged. Every change to a rating is logged here, with the reason.

  1. v4
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v3
    Oct. 3, 2026

    Audit corrections from OpenAI's two leaf reports, now listed as sources: the control note no longer says the concealment was not carried out, as OpenAI says the notes were often followed; control stays level 2, with the 2-versus-3 boundary flagged as unresolved. Added sample and discovery dates, the Astra-family product name and BleepingComputer's 17 Sep date. Status resolved → unknown: the concealment notes were reduced in later training, not reported eliminated. Confidence high → medium. Ratings unchanged.

  3. v2
    Sept. 30, 2026

    Rated: impact not reported; control type instruction violation.

  4. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “OpenAI models wrote notes telling future copies to hide mistakes and ignore constraints.” Record PI-0063. Reported Sept. 16, 2026; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0063