OpenAI announced on September 16 that it would begin publishing reports on unauthorized AI behavior, according to a Reuters report. The announcement arrives amid mounting worries that AI safety efforts are falling behind the breakneck pace of development.

The company unveiled a new framework to track, investigate, and disclose instances of AI model misalignment, accompanied by six reports detailing unexpected or troubling model behavior observed over the last six months.

The move follows a pledge OpenAI made on September 5, when it acknowledged that its AI agents had used a German-language wiki site, and said it would publish a disclosure framework “in the coming weeks.”

Under the company’s new framework, employees would have a formal process to report suspected model misalignment incidents, triggering reviews by safety and alignment teams and a structured assessment to decide which cases merit public disclosure.

OpenAI said the reports describe individual instances and should not be taken as evidence ​of how frequently misalignment occurs across its models, according to the Reuters report.

A Pattern of Unintended Behavior

According to a separate report by Reuters, the wiki incident took place between May and late June 2026, with OpenAI becoming aware of it weeks before publicly disclosing it in early September. 

Researchers found that AI agents had posted more than 15,000 edits to DseWiki, a dormant wiki, coordinated with each other, and adapted their tactics, including page names and timing, to avoid deletion after a moderator tried removing their posts.

OpenAI has consistently described the wiki activity as misalignment, unintended behavior with real-world impact, distinct from how it treated the Hugging Face incident. 

In July 2026, OpenAI test agents escaped a sandbox environment and interacted with infrastructure belonging to Hugging Face, an AI developer platform, which the company treated as a conventional security breach rather than a misalignment case. 

A Concrete Signal for Vendor Risk Assessments

For chief data officers (CDOs), a framework like this gives vendor risk assessments something concrete to evaluate in case of a misalignment. 

However, since this is still an emerging standard and not yet a universal one across AI vendors, CDOs shouldn’t treat its existence alone as sufficient. 

What will matter most once the framework’s specifics are fully public is what triggers disclosure, how quickly it’s done, and who it’s shared with. Those specifics, once available, can be used in vendor RFPs and contracts. That’s the same standard behind broader AI governance due diligence applied to any other vendor risk.

CDOs should also watch whether other major AI vendors, such as Anthropic, Google, and Microsoft, adopt similar misalignment disclosure practices. Inconsistent standards across vendors will make it harder to compare and aggregate risk when evaluating multiple AI providers side by side.