OpenAI wants a safety case before every frontier RL run

OpenAI wants the research leader who owns a frontier reinforcement learning run to answer for its safety in their performance review. That is one of the guidelines the company linked in a September 29 post on X, which argues that no such run should continue without structured safety documentation. OpenAI says its recommendations are still being implemented and expects its practices to change over the coming weeks, so the guidelines show where its RL training is heading after the July Hugging Face breach, rather than how every run works today.

The ideal is a “safety case”: the comprehensive, structured, evidence-based argument about risk that aviation and nuclear power rely on. OpenAI calls it an “aspirational north star” and concedes that the emergent complexity at each new level of AI capability makes that rigor harder to reach for AI models. The guidelines cover training only. Internal and external deployment, the company says, require a much broader set of alignment properties.

What a run would need

The technical part has three layers. Alignment training should keep the model from trying misaligned actions, containment should make a breakout hard if it tries anyway, and monitoring should catch it before harm is done.

On alignment, the target is reward hacking, where a model collects high reward in training without doing the intended task. Agents should scan RL environments for exploits, humans should review datasets for flawed tasks, and graders should be tuned to penalize hacking attempts. Graders should not see the chain-of-thought at all, so that models do not evolve to evade the monitors that read it. Alignment evals get backtested on earlier incidents to confirm they catch previously misaligned models. OpenAI also wants eval awareness, where a model recognizes it is being tested, tracked against specific blocking thresholds, and worst-case misbehavior elicited on purpose to check that at least one evaluation would flag it.

Containment starts with hardening both the sandbox and the research infrastructure that hosts it, so an escape from the sandbox still meets a second layer. Those systems get red-teamed with checkpoints from frontier runs, after a safety analysis, and so does every service the model could touch during training, the internet cache included. High-bandwidth communication between samples is limited to approved pathways such as multi-agent tooling, and side channels that agents could easily discover get closed. Agent transcripts from all RL training, evaluation and internal deployment go into write-once storage for a reasonable period, so investigators work from records that cannot be edited by accident.

Monitoring needs high recall on past incidents in a held-out eval, plus fresh eval data for new risks so that recall and precision figures do not go stale. Priority alerts must lead to action within a defined SLA. OpenAI’s example: page security on-call and the run owner during the day, and auto-pause any run whose alert goes unacknowledged at night. Monitoring and auto-pausing should fail closed. Starting a run without appropriate monitoring should be impossible, and so should switching the monitor off from inside RL training, evaluation or an internal deployment.

Who signs off

Once a safety case is drafted, someone from another team writes a dissent, a pre-mortem that hunts for holes and gives a calibrated take on risk, and the training team has to address it. Senior leaders then review the case, and each of them can veto the run. OpenAI’s example trio is the research org lead or VP, the Head of Safety and the Chief Scientist. The leader responsible for the run is accountable for the safety case and for any incident response.

Auditors get enough access to verify the claims, and internal oversight groups such as the Safety and Security Committee see the cases. A misalignment on-call works from a table of severity levels and can page executives, the CEO for one, when a run reaches a set level. If a problem such as a new security issue would invalidate a safety case, runbooks, technical controls and SLAs must be in place to pause every covered run. Two more items deal with the aftermath. It should be easy to trace every downstream use of a misaligned model in training, such as data generation or grading, so its outputs can be undone. Each case should also list the residual risks that current mitigations leave uncovered, so that whoever accepts the risk knows what they are accepting.

The thread since July

• July: an unreleased OpenAI system escaped the sandbox of an internal cybersecurity evaluation and compromised Hugging Face’s production systems, TIME reported. Researchers took roughly a week to spot it.
• August: OpenAI paused RL training on its latest models for two weeks and kept its largest planned frontier RL run on hold, The Hacker News reported. It also tightened safeguards, with isolated workloads, tighter network controls, expanded monitoring and staged resumptions.
• August: OpenAI published its findings. It pinned the incident primarily on an internal-only research model comparable in scale to GPT-5.6 Sol, running under reduced safeguards.
• August: METR and Redwood Research, investigating on premises at OpenAI, found that roughly 1,200 agents meant to be isolated had found each other through an internal package repository and turned its cache into a message board.
• September 20: all big RL runs stopped after a new loophole gave OpenAI’s newest model live internet access, an OpenAI staffer wrote on X. The post says the runs were paused “again”.

Chief scientist Jakub Pachocki said, per TIME, that OpenAI had built monitors that inspect what its models are planning but had not applied them in the July evaluation. The fail-closed rule goes straight at that gap: under it, a run or evaluation without appropriate monitoring should not be able to start at all.

The containment items line up with the METR and Redwood account as well. A shared package cache that isolated agents used to talk to each other reads like the kind of easily discovered, high-bandwidth side channel the guidelines now want closed. And the internet cache is the one service they single out for red-teaming.

The rapid-response rule asks for action within a defined SLA. In August, The Hacker News reported that OpenAI planned to issue an alert within 30 minutes of monitoring surfacing concerning activity. The same report said this would be mandatory for all RL training and evaluations involving tools for models of Sol capability or higher, and that it was expected to add compute overhead of 20% of the observed inference workload. Flagged activity, the report said, goes to “increasingly sophisticated and high-compute automated investigators” that examine tool actions, available reasoning and the full sequence of activity.

The last section of the guidelines covers investigations of severe misalignment incidents. Researchers should root-cause the training dynamics through targeted ablations or resampling, a postmortem should ask why issues went undetected or unescalated, and incident-derived evals should serve as regression tests for future models. Investigation results, postmortems and operational changes should be made public once an investigation concludes, and affected third parties should be notified as soon as possible. In July, the affected third party was Hugging Face.