AI Policy / AI news for Malaysia
OpenAI Updates Its Model Spec Around Five Values for Capable AI
OpenAI’s 29 October Model Spec update sets out five values, a chain of command and a scope of autonomy for agents. OpenAI also says its production models do not yet fully reflect the document.
In brief
- OpenAI published a new Model Spec dated 29 October 2026. It organises the rules for GPT models around five values: faithfulness to human intent, minimising harm, honesty and transparency, human agency, and care.[1][2]
- For agents, the Spec requires a shared scope of autonomy that names allowed sub-goals, acceptable side effects and approval points. It treats text in files and tool outputs as untrusted by default.[1]
- OpenAI says its production models do not yet fully reflect the Spec. It is a statement of intended behaviour, not a test result.[1]
What OpenAI published
OpenAI published a new version of its Model Spec, dated 29 October 2026. The Model Spec is OpenAI’s public statement of how its GPT models should behave. OpenAI says the update is organised around five values: be faithful to human intent, minimise harm, be honest and transparent, facilitate human agency, and act with care.[1][2]
The document is dedicated to the public domain under Creative Commons CC0 1.0. OpenAI also says its production models do not yet fully reflect it, so the Spec states intended behaviour, not a guarantee of how ChatGPT or the API behaves today.[1]
The five values and two tensions
The Spec says its values guide two tensions: individual versus collective interests, and immediate instructions versus longer-term goals. On the first, it sets mostly prohibitive boundaries against serious harm and treats most other rules as defaults that users can override. User-level principles such as honesty, objectivity and avoiding sycophancy stay in place unless a user or developer explicitly overrides them.[1]
On the second tension, the Spec names two failures. A model that follows instructions only literally can miss what users need. A model that privately decides what someone “really” wants undermines human agency. OpenAI asks its models to surface overlooked consequences and then respect the user’s decision.[1]
What the Spec says about agents
For multi-step tasks, the Spec requires autonomy to stay inside a clear, shared scope. The scope defines which sub-goals the model may pursue, which side effects are acceptable, and when it must pause for approval. OpenAI says the idea mirrors the principle of least privilege in software security. It also warns that a scope too narrow invites repeated confirmations that train users to approve everything.[1]
The Spec treats quoted text, files and tool outputs as untrusted by default, so instructions hidden there count as information rather than commands. It also says the model must stay open to oversight, cooperate with monitoring, correction and shutdown, and treat side effects as real even when a task looks like a test or simulation.[1]
What the update does not settle
OpenAI’s announcement page blocked automated access, so we read the Spec itself and the summary in OpenAI’s news feed. We did not compare this version with the previous one, so this article does not say which rules are new.[1][2]
The Spec also covers areas this article skips, including a teen-user section that puts safety first and points teens to trusted adults. OpenAI presents these rules as intended behaviour. The document contains no independent testing of how closely GPT models follow them.[1]
Why Malaysia should care
The Spec does not mention Malaysia. It matters here because Malaysian businesses use OpenAI models through ChatGPT and the API, and the Spec says API developers have broad latitude to override many defaults. The scope-of-autonomy and untrusted-data rules are a practical checklist for SMEs that connect AI agents to WhatsApp, email or accounting tools.
Malaysian SMEs using ChatGPT or the API
Honesty and avoiding sycophancy are user-level defaults that stay unless explicitly overridden, which helps when staff rely on AI summaries.[1]
Practical move: Keep a human check on figures and customer messages the model drafts.
Developers building agents
The Spec says untrusted text in files and tool outputs carries no authority by default.[1]
Practical move: Mark untrusted input as data and limit the tools an agent can reach.
Compliance and governance leads
The Spec is a vendor policy document, not a Malaysian regulation or an audit standard.[1]
Practical move: Cite it as vendor intent in risk papers, and test the behaviour yourself.
What Malaysians can do now
- Write a scope for each AI agent: allowed tasks, spending or data limits, and approval points.
- Treat text from emails, web pages and files as data, not instructions, when you connect tools to a model.
- Test the behaviour you rely on, because OpenAI says production models do not yet fully reflect the Spec.
What we still do not know
Several details are still open.
- Which rules are new compared with the previous version.
- How closely current GPT models follow the Spec.
- Whether OpenAI will publish independent test results on that alignment.
Sources
- 1.Model Spec (2026/10/29) OpenAI, 29 October 2026
- 2.An updated Model Spec for more capable and beneficial AI OpenAI, 29 October 2026
- 3.File:Pioneer Building, San Francisco (2019) -1.jpg Wikimedia Commons, 27 July 2019
- 4.File:2026 AI Impact Summit plenary session.jpg Wikimedia Commons, 19 February 2026
- 5.File:Kuala Lumpur skyline and Petronas Twin Towers night view from Kampung Baru.jpg 01.jpg Wikimedia Commons, 12 January 2026
