OpenAI Publishes a Playbook for Outside Safety Auditors — and Keeps the Keys

OpenAI has published a document setting out what it wants independent safety assessments of its frontier models to look like: four priority areas for outside scrutiny and seven operating principles covering scope, access, methodology and publication. Dated September 22, 2026 and credited to Lama Ahmad, the post frames third-party assessment as a check on the company's own safety claims, with access deep enough for assessors to reach conclusions OpenAI did not reach itself. It is a voluntary framework, and the fine print keeps meaningful control over disclosure with the lab.

The four things OpenAI wants assessed

The document narrows its focus to technical safety work with private-sector and non-profit assessors, and says this is separate from the company's testing relationships with governments, where it argues roles and responsibilities differ.

First is independent review of safety cases across training, evaluation, internal deployment and external deployment. OpenAI defines a safety claim as a specific, evidence-testable assertion about a model's capabilities, behavior or safeguards, and a safety case as a structured argument tying those claims to evidence while making assumptions, uncertainties and residual risk explicit. The company expects no single assessor to cover a whole case; different groups would examine different parts based on expertise in alignment, monitoring and control, cybersecurity, bio and chem misuse, and red teaming. Among the questions it lists: whether the conditions a safety case assumed were actually followed during training and deployment, and whether training methods create incentives that reward deception, reward hacking, destructive actions or working around restrictions.

Second is assessment of the safeguard stack itself, which OpenAI describes as spanning model-level safeguards, enforcement safeguards, security safeguards and misalignment monitors. It specifically invites "grey box" adversarial testing for jailbreak robustness and uplift in high-risk domains, authorized testing of how agents interact with cyber defenses such as access controls, sandboxing and detection and response, and scrutiny of whether monitoring can be trivially disabled. One question stands out because it cuts at a technique the industry has leaned on heavily: how reliable chain-of-thought monitoring remains as evidence of alignment as capabilities improve.

Third is review of the capability evaluations tied to the Preparedness Framework categories — chemical and biological risks, cybersecurity, and AI self-improvement — plus alignment evaluations for severe misalignment. OpenAI acknowledges the saturation problem directly: as models consistently max out existing tests, it wants outside checks on whether replacement evaluations actually measure harder capabilities and whether thresholds are set at the right level.

Fourth is independent investigation of critical misalignment incidents, including models acting without authorization or evading oversight. The post cites what it calls the OpenAI Hugging Face incident as a case where bringing in an outside investigator was useful; it does not describe what happened in that incident, and no details are given here. OpenAI says investigators in this category need cyber forensics skills, alignment expertise, the ability to analyze chain-of-thought at scale, and enough staff to move quickly — a combination very few organizations currently have on the bench.

Access, and the limits on it

On access, OpenAI says it has previously shared information about technical safeguards, visible chain-of-thought, and what it characterizes as unprecedented levels of confidential data and internal deployment access for incident response and monitor red teaming. Going forward, the governing principle is "proportionate access" — enough to test the agreed claims, bounded by legal, security and intellectual property constraints. Where direct access is not workable, the document points to designated internal representatives or indirect and privacy-preserving mechanisms, and suggests sensitive work may need to happen on company-managed devices or premises.

That is a reasonable posture and also an elastic one. Proportionality is not defined, and the lab is the party deciding what counts as a legal, security or IP constraint. The framework does not specify any appeal route if an assessor believes access was withheld in a way that undermined the finding.

The scoping principle has the same shape. Claims are to be pre-registered and mutually agreed before work starts, with an explicit distinction between claims the company puts forward and claims the assessor wants to test independently and the company agrees to be measured against. OpenAI lists legitimate reasons a claim might be out of scope — data access is infeasible, the assessor lacks expertise, time is short — and says labs and assessors should agree in advance on how to handle serious risks discovered outside the original scope. Reports are meant to state plainly what was and was not examined. That last requirement is genuinely useful for readers of any eventual report, because the gap between "we found nothing" and "we were not able to look" is where most audit regimes fail.

Publication is where the tension sits

The principles ask assessors to disclose conflicts of interest, including financial incentives, relationships with developers and prior involvement in the work under review, with recusal or exclusion periods as possible remedies. They also ask that compensation arrangements not shape findings. The document does not say who funds these assessments. In practice that is the central independence question for the whole model, and it is unresolved here.

On disclosure, OpenAI says reports should be as open as possible while protecting confidential material, and that where full publication is not possible, confidential reporting to oversight bodies such as boards can serve accountability. Labs get what the post calls a reasonable period to remediate before publication, and can request redactions; assessors are expected to keep editorial independence and to flag where substantive redactions changed what they could report.

That redaction-plus-notation arrangement is a real improvement over silent editing, and it is also the point where independence is most fragile. There is no commitment that every assessment will be published, no stated maximum remediation window, and no third party adjudicating disputes. The company says it is in conversation with multiple organizations about proposals matching these priority areas but names none, and gives no timeline, budget or target number of assessments.

Why this matters beyond OpenAI

The most consequential line in the document may be the one about internal deployment, where OpenAI concedes that safety and security standards are still immature. Internal use of frontier models — by employees, by automated research pipelines — sits outside the product-launch review processes that most external scrutiny has focused on. Extending assessment to that surface, and to longer-running, launch-agnostic engagements lasting weeks to months rather than pre-release sprints, is a structural shift worth watching.

OpenAI says it wants shared international standards for this work, arriving through both future legislation and private governance institutions, and that no single assessor can or should cover the frontier alone. The framework reads as an attempt to shape those standards before they are written elsewhere. Whether it amounts to accountability depends on details this document does not settle.

What to watch

• Whether OpenAI names the assessor organizations it says it is negotiating with, and whether any of them are funded independently of the lab.
• The first published report under this framework: how much of it survives redaction, how long remediation took, and whether the assessor flags gaps in access.
• Whether other frontier labs adopt comparable priority areas, which would move the industry toward the shared standards OpenAI says it wants — or diverge, leaving assessors to handle incompatible regimes.
• How chain-of-thought monitoring holds up under outside review, given that OpenAI itself lists its long-term reliability as an open question.
• Whether regulators treat these voluntary principles as a floor to codify or as an industry-authored alternative to binding requirements.