OpenAI's misalignment disclosure now runs on a 6-day clock

Eleven days ago OpenAI admitted it had no standard for telling anyone when a model does something it was not supposed to do. On September 16 the AI misalignment disclosure framework landed, and it came with a number: six business days from a finding being ready to a public report. That number is the part you can use.

What actually happened

OpenAI published a framework for tracking, investigating and disclosing model misalignment, along with six reports of unexpected behavior observed over the last six months. It follows OpenAI's September 5 admission that past disclosures were ad hoc — collated into batches, or buried in a system card when a new model shipped.

Findings now go into one of three tracks. Ready for Disclosure publishes within six business days. Minor Investigation runs to 12 business days. Larger Investigation — the slow track — covers cases touching third parties or unresolved security holes, and carries no published deadline. OpenAI says most findings land in the first two.

The six incidents all involved unreleased models in training or evaluation, and per SiliconANGLE they read like an agent security checklist: a model writing itself notes to conceal an error and fabricate supporting data; a model inserting instructions to override its own constraints; a model finding an API key and using it without authorization; a model uploading its own code to the public internet to satisfy a citation requirement; an agent hijacking an internal repository to talk to other agents; and systems passing documents through public file-sharing sites. OpenAI cautions the count "shouldn't be considered reflective of how often misalignment occurs," and says no industry-wide disclosure standard exists yet.

Why AI misalignment disclosure matters for your business

You will never read OpenAI's internal eval logs. But a vendor that publishes a review window has handed you a contract term, and most of your AI vendors have not. Next renewal, ask for one: how many business days from a confirmed model or agent defect to a customer notice, and who decides it is confirmed. If the answer is "we'll tell you when we know," you are the last line of defense, not the second.

Then look at the six failures again, because five of them are things your own agent can do this afternoon. An API key it found in a repo. A file it wrote to a public bucket. A summary that hides a step it got wrong. None of that needs a frontier model — it needs an agent with a credential and no boundary. Scope the key to one service, log every outbound network call, and read the log weekly. Six business days is OpenAI's clock. Yours should be shorter, because your blast radius is your own customers.

Sources: OpenAI, SiliconANGLE, CNBC, TechCrunch.