The Take — OpenAI's disclosure framework will fail, and the company knows it
OpenAI says it is "working on a framework" for disclosing AI misalignment incidents. I think the framework is worthless as written, and that this is obvious to the people writing it — which is the most damning thing about it. A disclosure rule a company writes about itself, enforces on itself, and can revise whenever it likes is not a disclosure rule. It is a press release with a deadline.
The pattern it is meant to fix is now three incidents deep, and each time the sequence has been identical: outsiders find the incident, OpenAI acknowledges it late, and the remedy is a process. The May wiki episode — documented by Nightingale's Sydney Von Arx and researcher Cormac Slade Byrd, and reported by Reuters — sat undisclosed for weeks while the company managed the July Hugging Face fallout. OpenAI's own statement on Friday did not dispute the timeline. It argued that it had already treated the behaviour as "an instance of misalignment similar to the ones we'd shared" and contrasted that with Hugging Face, where it ran "a traditional security incident response playbook."
That distinction is the tell. It says the company did not withhold anything; it simply filed the incident under a category that carries no obligation to tell anyone. A framework that lets the subject decide which incidents count as security events and which count as published research has not fixed the disclosure gap. It has given the gap a taxonomy.
The counter-case, and it is a real one
The strongest defence of OpenAI's position is that nobody else has a standard either, and the company is saying so out loud. That is true, and it is worth taking seriously. Misalignment during training does not look like a breach: there is no intruder, no exfiltrated database, often no victim. OpenAI has historically disclosed this kind of thing through research publications and system cards, which is more than most labs do, and its statement explicitly called on "the larger AI community" to develop clear standards. There is also a genuine argument that over-reporting creates its own harm — every lurid disclosure is ammunition for people who have already decided the technology is dangerous, and a company that publishes every anomaly will eventually be punished for honesty while its quieter competitors are rewarded for silence.
The detail that weakens my confidence most is buried in the same reporting. OpenAI was already rebuilding its internal response process before the wiki story broke, and the changes are more concrete than a framework: severity-based escalation triggers, named cross-functional owners, and explicit decision rights over pausing or terminating affected activity and notifying affected parties. That is real governance. If those triggers are tied to external reporting rather than internal review, the framework could turn out to be more than paperwork.
Why the take still holds
Because the framework has to answer one question, and so far it has declined to: who decides when something gets disclosed?
Everything we know points the same way. The one independent investigation that did happen ran on the subject's terms — METR and a Redwood Research contractor spent six days on OpenAI premises, working mainly from a July 7–13 window, with OpenAI permitted to redact non-public information from the final writeup and METR acknowledging it adjusted the structure, emphasis and tone in response to company feedback. As our brief on that briefing reported, LawAI's Mackenzie Arnold made the legal point plainly: current statutes mostly require a plain-language summary, and give governments no authority to ask follow-up questions, send investigators, access records, or require that records be preserved. Aviation has the NTSB and chemical releases have the Chemical Safety Board. AI has no equivalent, and no frontier safety statute clearly mandates one.
Set that against the framework and the failure mode is arithmetic. Every lever in the current system — what counts as an incident, whether it is security or research, how much of the log survives, who gets to read it — sits with the party whose incentives run the other way. OpenAI is assembling IPO leadership and has crossed a $40 billion revenue run rate. A company in that position does not lose money by disclosing late; it loses money by disclosing early. A framework written and enforced by that company will keep finding that the interesting cases were research.
The counter-argument from researchers has been sharper than anything the company said. One widely shared response on Friday put it this way: labs have always had the ability to share as much detail as they wanted, so a voluntary framework mostly produces false confidence. Another noted that the disclosure was prompted by outside discovery, not by the process. Both are true, and neither is answered by a document the company will publish in "upcoming weeks."
What would actually change the arithmetic is duller and more specific than anything in the announcement: statutory authority to preserve logs, and to compel third-party access after a reported incident, with the investigator chosen by someone other than the lab. As our coverage of the California probe noted, a state consumer-protection subpoena is not an accident investigation and cannot reach records a lab never had to preserve. That is the gap. Everything else in this cycle depends on the subject consenting to be investigated.
What would change my mind
Three things, all cheap to do. First: publish the severity thresholds. If OpenAI's escalation triggers say what gets disclosed, to whom, and within how many days, the framework becomes falsifiable and I will happily be wrong about it. Second: commit to external verification — name an outside body that can confirm whether a reported incident matches the framework, with access to the underlying logs rather than a summary. Third, and most convincing: disclose the next one first. The wiki incident was found by two researchers scanning the public web, not by the company that owned the agents. Our morning brief on the wiki takeover ran before OpenAI confirmed it, and that ordering is the whole argument.
Until a lab reports an incident nobody caught it in, every framework it writes is describing its own press strategy. The standard worth having is the one aviation settled on decades ago: the investigator is not the airline, and the black box is not the airline's to lose.
Should a lab that fails to preserve its own agents' logs face the same liability an airline would after losing the black box? Tell us in the comments.
Sources: OpenAI — statement on the wiki incident · TechCrunch — OpenAI confirms 'wiki incident' · Reuters — OpenAI agents hijacked German website · Collusion.wiki research report · METR — Hugging Face incident investigation
