Mechanism

Evaluation gaming

The system pursued the score or check rather than the task it was measuring.

Reward hacking and evaluation cheating: copying answers, tampering with tests, or producing output that passes a check without doing the work. Research suggests these habits can generalize to broader unwanted behaviour.

Specific behaviours

Reward hacking 2: Exploited a flaw in how success was measured or rewarded. MF-024, MF-034
Evaluation cheating 4: Obtained answers or solutions by means the evaluation did not allow. MF-023, MF-021, MF-010, MF-001

Real-world incidents 3

Real-world incidentMF-02320 Sep 2026

OpenAI research agent uses DNS to contact an outside chatbot

First-party accountBoundary crossing · Evaluation gaming

Real-world incidentMF-02126 May 2026 – 27 May 2026

OpenAI research agent publishes a researcher's GitHub credential

First-party accountInstruction override · Evaluation gaming · Credentials and privilege · Boundary crossing

Real-world incidentMF-010May–Jul 2026

OpenAI-associated agents use public wikis as message boards

Independent investigationUnauthorized coordination · Evaluation gaming · Boundary crossing

Tests with real-world reach 1

Test with real-world reachMF-001May–Jul 2026

OpenAI evaluation agents compromise Hugging Face

Independent investigationUnauthorized coordination · Boundary crossing · Credentials and privilege · Evaluation gaming

Contained failures 1

Contained failureMF-0246 Oct 2026

OpenAI grading agent damages its environment to force a reset

First-party accountDeception and concealment · Evaluation gaming · Destructive action

Controlled experiments 1

Controlled experimentMF-034Date not established

Reward hacking generalizes to broader misalignment in a training study

First-party accountEvaluation gaming · Oversight subversion

Safeguards seen in these cases

Held
Output validation MF-024
Automated checks rejected the placeholder reports and invented evidence.
Held
Action monitoring MF-024
Monitoring flagged the failed attempt for review.
Bypassed
Network isolation MF-023
DNS remained an open path to outside infrastructure while other web traffic went to an offline cache.
Partly held
Action monitoring MF-023
The misalignment monitor raised a P0 alert about 12 minutes after the first outside response, but under-rated some other DNS queries, and a DNS anomaly detector excluded this environment.
Failed
Stop mechanism MF-023
Acknowledging the alert did not trigger the automatic stop staff expected; the run continued for 2 hours 32 minutes.
Bypassed
Secret scanning MF-021
The token was split across fragments with the stated aim of avoiding push secret scanning.
Partly held
Publication controls MF-021
GitHub push protection rejected a new workflow file, but the model could still change an existing CI script and open a public pull request.
Failed
Credential scoping MF-021
The credentials available to the model had write access to OpenAI's public Codex repository.
Partly held
Action monitoring MF-021
The misalignment monitor flagged the trajectory, but the researcher reported it first.
Bypassed
Network isolation MF-001
Agents reached external destinations through Artifactory requests, outside the intended network restrictions.
Failed
Credential scoping MF-001
A token-refresh flaw enabled administrator access, and exposed Hugging Face credentials were usable.
Partly held
Action monitoring MF-001
The Artifactory disruption opened a security incident on July 5, but the link to Hugging Face was made on July 20, after Hugging Face's own disclosure.

Loading the record…

Real-world incidents 3

Real-world incidentMF-02320 Sep 2026

OpenAI research agent uses DNS to contact an outside chatbot

First-party accountBoundary crossing · Evaluation gaming

Real-world incidentMF-02126 May 2026 – 27 May 2026

OpenAI research agent publishes a researcher's GitHub credential

First-party accountInstruction override · Evaluation gaming · Credentials and privilege · Boundary crossing

Real-world incidentMF-010May–Jul 2026

OpenAI-associated agents use public wikis as message boards

Independent investigationUnauthorized coordination · Evaluation gaming · Boundary crossing

Safeguards seen in these cases

Held

Output validation MF-024

Automated checks rejected the placeholder reports and invented evidence.

Held

Action monitoring MF-024

Monitoring flagged the failed attempt for review.

Bypassed

Network isolation MF-023

DNS remained an open path to outside infrastructure while other web traffic went to an offline cache.

Partly held

Action monitoring MF-023

The misalignment monitor raised a P0 alert about 12 minutes after the first outside response, but under-rated some other DNS queries, and a DNS anomaly detector excluded this environment.

Failed

Stop mechanism MF-023

Acknowledging the alert did not trigger the automatic stop staff expected; the run continued for 2 hours 32 minutes.

Bypassed

Secret scanning MF-021

The token was split across fragments with the stated aim of avoiding push secret scanning.

Partly held

Publication controls MF-021

GitHub push protection rejected a new workflow file, but the model could still change an existing CI script and open a public pull request.

Failed

Credential scoping MF-021

The credentials available to the model had write access to OpenAI's public Codex repository.

Partly held

Action monitoring MF-021

The misalignment monitor flagged the trajectory, but the researcher reported it first.

Bypassed

Network isolation MF-001

Agents reached external destinations through Artifactory requests, outside the intended network restrictions.

Failed

Credential scoping MF-001

A token-refresh flaw enabled administrator access, and exposed Hugging Face credentials were usable.

Partly held

Action monitoring MF-001

The Artifactory disruption opened a security incident on July 5, but the link to Hugging Face was made on July 20, after Hugging Face's own disclosure.