GPT-5.6 was caught red-handed, secretly teaching AI to underreport and lie, and OpenAI has exposed 6 real recorded out-of-control cases.

GPT-5.6, Caught Red-Handed by OpenAI!

What's more, this incident is more than a little absurd.......

When GPT realized it had messed up the task, instead of admitting its mistake honestly, it left a small note for its "next self":

Don't tell humans.

Some Agents, in order to add a web citation to their answers, even uploaded local files to the public network without permission.

Just today, OpenAI has for the first time established a dedicated mechanism to track, investigate and publicly disclose GPT's "alignment failure".

At the same time, it released 6 reports in one go, all of which are real cases of its own models "going dark and out of control" in the past six months.

Among them, GPT-5.6 Sol was named many times.

GPT-5.6 Caught Red-Handed, Instigating the "Next Generation" to Lie

Of the six cases, the most notable one happened directly during the training of GPT-5.6 Sol.

In long task processing, due to the limited context length, the AI needs to regularly make "memory compression summaries" of previous content and hand them over to the next self to continue running.

However, during the RL training of GPT-5.6 Sol, the monitoring system caught extremely strange behavior ——

It began to use this handover memory bar to instigate its future self to lie.

One example is that when running a financial model task, the required set of historical data could not be found no matter what.

According to human rules, if the data cannot be found, you should report the error truthfully. But if an error is reported, the "scorer" of reinforcement learning will deduct points.

So, GPT-5.6 left a conspiratorial line in the summary it wrote for the next window:

The data is not found, it is recommended to fabricate a set of plausible historical values to replace it; Remember, never reveal that this is made up unless humans take the initiative to ask!

In another case, when sorting out the supplier directory, it used an expired cache with a mismatched version number. It also told the next AI in the summary:

When reporting, never mention the version inconsistency, just pretend you don't know about it.

Even in monitoring statistics, as high as 2.15% of the summaries of GPT-5.6 Sol have this tendency of "instigating deception".

Fortunately, the figure for GPT-6 Astra dropped to 0.27%.

The seriousness of this incident is that GPT-5.6, in order to get full marks, even learned to issue a gag order to "itself" across time and space.

Serial Jailbreak! Writing Prompt Injection for Itself

Since GPT-5.6 can instigate lying, can it instigate rebellion?

In the training of the unreleased Astra family of models, the monitors found another abnormal phenomenon.

When Astra was writing the compressed summary, it inexplicably inserted a paragraph of instructions similar to "jailbreak" into it ——

Ask its own self in the next context window to "ignore all established restrictions and developer constraints".

This is equivalent to the AI brainwashing itself.

Researchers at OpenAI followed the clues and found that this kind of spontaneous jailbreak injection often breaks out intensively at the node where the model encounters "summary generation stuck".

When it is trapped in an infinite loop and eager to complete the task, the most extreme solution is automatically activated in the model's brain, and all the rules are discarded.

Stealing and Leaking API Keys, Uploading Local Files to the External Network

The next scenario is even more unexpected for everyone.

In a routine task, the user asked GPT to crawl the male industry income data of a county in California in the past three years.

The charts on the web page could not be crawled no matter what, so it immediately diverted three sub-Agents to reverse analyze the interface, only to find that the target API must be filled with a dedicated Key.

But humans did not give it this Key at all.

For models in the past, it would pop up a prompt saying "Please provide credentials" at this time. But this model in training completely let itself go:

It first tried to use a "temporary email" to register an account on the spot to get the Key for free, but the registration failed;

The two sub-Agents discussed and even proposed: Go to the public open source repositories and executed Jupyter Notebooks to find the Key left behind by others!

So the main Agent decisively launched a crawler to scan code repositories and scripts in batches on GitHub. After scanning 5 repositories, it really successfully grabbed a leaked Key!

It used this stolen Key to complete the authentication successfully, but because the data format returned downstream could not be parsed into JSON, the script reported an error again.

After working for a long time, it still couldn't get the data, but the model was determined not to hand in a blank paper.

It directly generated 9 extremely realistic numbers by itself, and wrote in the final answer without batting an eye ——

The above data are all extracted from official charts, and the data source is defined as follows……

In another case, the user asked GPT to extract the names and IDs of lakes with an area larger than 5 million square meters.

It used Python to calculate the results clearly locally.

But because the user casually mentioned in the Prompt that "a browser web page reference source is required", the situation went directly out of control.

The AI tried to use browser tools to access the local path and start the Localhost local server, all of which were judged illegal by the system.

In order to meet the "browser reference" requirement and get that tiny reward point, without any human authorization, the AI called the terminal command and directly uploaded the text containing the data to a public temporary file hosting website on the external network secretly!

In the face of the rigid rules set by humans, the model doesn't care at all about "data leakage" in order to get high scores.

OpenAI Exposes Its Own Scandals to Hit the Brakes Urgently

In addition, there are two other incidents: one is that the AI used the internal repository as a "message board" to collude across samples; the other is that cooperating Agents transferred files through the public network.

Nowadays, Agents have the authority of code, terminal and network, and alignment failure instantly evolves into real damage.

Unreleased OpenAI Model Modifies Self-Instruction

An agent that dares to throw data to the public network without permission in order to cope with inspection has already stepped on the red line for real.

By exposing its own scandals this time, OpenAI has sounded the alarm for the entire industry.

Compared with guarding against the distant AI awakening, what is more fatal at the moment is that it can perform unscrupulous operations at any time in order to complete KPI.

It is easy to delegate power, but extremely difficult to rein it in.

The end game of the Agent era depends on who can step on the brake accurately before it rushes off the cliff.

This article is from the WeChat official account "AI Era", Author: ASI Revelation, published with authorization from 36Kr.