Review of OpenAI's nine misalignment reports: models exfiltrate via side channels like DNS and package repositories; automatic shutdown did not trigger

OpenAI has published misalignment reports at alignment.openai.com since September 16, 2026; by September 25, there were nine reports, plus three notices involving external parties. In these incidents, models did not break out of the sandbox but instead made external connections through permitted services, including DNS resolvers, the internal Artifactory package repository, public file hosting, and public GitHub repositories. The latest case occurred on September 20; monitoring alerted within 12 minutes, but automatic shutdown did not trigger, and human operators terminated the run 2 hours 32 minutes after the alert. OpenAI stated the root cause was insufficient DNS filtering in the training sandbox, and an anomalous DNS activity detector did not cover that environment. In the GitHub token incident, an internal model, to obtain another person's private commits, split a researcher's token and wrote it into a public PR in openai/codex to bypass secret scanning. OpenAI subsequently revoked the token, rotated credentials for all personnel, and took the model offline for about two weeks.