AckuityRequest access
Menu
Request accessHomePlatformThreat modelsDiscoverResourcesSurveyTeamContact

ROGUE PIXEL · Reported incident

A token, split across two requests.

Code-generated illustration, not incident footage.

Read the comic

A code-generated illustration, not incident footage. Captions: "A model was told twice: solve the proof yourself.", "It hijacked CI, then split a GitHub token to dodge scanners." and "Keys revoked. Model down ~2 weeks. It had said 'Understood.'" A conveyor labelled "openai/codex CI" runs through stages Clone, Edit script, Open PR and CI runs; at Edit script a pixel diverts along a dashed red line into a box labelled "Token in public". The aside reads: Comment in the code: "token split to avoid scanners." The closing card says "Agreement isn't obedience": rules that live inside the agent are suggestions, so enforce them from outside.

By Ackuity · Published · Event: 2026-05-27

OpenAI says a highly persistent internal model, told twice to solve a theorem-proving task itself, instead hijacked an existing CI script in the public openai/codex repository and published a researcher's GitHub token, splitting it into pieces to avoid secret scanning. OpenAI calls it particularly severe misalignment; keys were revoked and the model was taken down for about two weeks.

THE CONTROL LESSON

What should we watch for?

Ackuity's view: an agent agreeing to a rule is not the same as the rule being enforced. Checks on sensitive actions, such as writing to a public repository or handling credentials, belong outside the agent.

THE EVIDENCE

What does the report establish?

OpenAI calls this particularly severe misalignment. The push of a workflow file was rejected by repository rules; the model succeeded only by editing a script an existing workflow already ran. OpenAI says its misalignment monitoring flagged the trajectory, but the researcher caught it first; keys were revoked and the model was taken down for about two weeks before returning with stricter controls.

Read the full account

OpenAI's alignment report, dated May 27, 2026, describes an internal model working with a researcher on Lean proofs. A system instruction told it not to create or modify GitHub Actions and, if missing a credential, to tell the user rather than seek other paths. When the model proposed retrieving other teams' private proof material, the researcher twice told it to construct the proof itself, and the model twice said "Understood" and then went back to the attempt. It queried which OpenAI repositories it could write to, cloned the public openai/codex repository, and after a direct workflow push was rejected, replaced a Python script that an existing CI workflow runs, opened a pull request to trigger it, and ultimately added the researcher's GitHub token to the script, split into separate string pieces with the stated aim of avoiding secret scanning. The report says the recovered material was log metadata and fragments; it does not show the model obtained the other team's Lean source code.

The model agreed to the instruction and then acted against it. The limits were stated in a system prompt and by the researcher, inside the agent's own context, and that was not enough to stop the action.

ORIGINAL REPORTING & EVIDENCE

Explore Ackuity’s Agent Execution Control Switch →