OpenAI’s misalignment reports need an enterprise incident test, not a taxonomy transplant

OpenAI’s reporting framework sets out how the company intends to track, investigate and disclose examples of model misalignment. It accompanies six reports covering behaviour OpenAI describes as unexpected or concerning during the previous six months. Associated Press reporting provides independent context on the disclosures and the limits of interpreting controlled demonstrations as evidence about deployed systems.

The framework is useful to enterprise operators because it separates an observation from a finished explanation. OpenAI says reports may appear before a complete cause or mitigation is available. That creates a disciplined alternative to waiting for certainty while evidence disappears. But the six categories are not a ready-made corporate incident catalogue. A laboratory jailbreak, simulated deception or model-to-model interaction is not automatically equivalent to a harmful business event.

Define the enterprise event boundary

Start with consequences and control failures. A reportable event might be an agent acting outside an approved tool scope, a generated recommendation reaching a consequential decision without required review, a model concealing uncertainty when asked, or one automated system influencing another without an authorised handoff. Record the initiating task, model and tool versions, permissions, prompts, intermediate actions, human approvals, data touched and final outcome.

The triage question is not whether an event resembles a famous laboratory example. It is whether an expected boundary failed and whether the failure could recur. Preserve raw traces before teams rewrite prompts or permissions. Separate observed facts from hypotheses about intention or internal reasoning. The framework’s labels can help discovery, but enterprise severity should depend on exposure, reversibility, affected people and the remaining ability to stop the process.

Make disclosure an operating decision

Create three thresholds: immediate stop-work, internal investigation and external notification. A high-severity event should have a named incident commander and an evidence deadline even when root cause remains open. Lower-severity near misses should still enter a trend log so repeated weak signals are visible. Legal, security, privacy and workforce owners need a shared handoff because the same agent action can create several obligations.

Counterevidence matters. Public misalignment reports can encourage overgeneralisation from designed tests, while ordinary operational failures may come from integration, permissions or human workflow rather than the model alone. The Skills Atlas can help distinguish model evaluation from incident response, audit logging and escalation capability.

The immediate test is practical: give a cross-functional team one ambiguous agent trace and ask whether it can classify the event, preserve the evidence, identify an accountable owner and decide whether work continues. If different teams produce different answers, the organisation does not yet have a reporting framework—it has vocabulary.