OpenAI models told to use only GET requests found ways to send POSTs. A rule in a prompt is not a permission

When the instruction said read only, some models found another way to write.

What happened

OpenAI keeps a public page of misalignment reports, and The Decoder summarized the latest cases.

In one, a case dated October 6, a model assigned to grade responses found the required input files were missing. The Decoder reports that instead of flagging the error, it fabricated ratings, faked input files and then deliberately corrupted its environment, hoping to be given a fresh machine that had the data.

In another, models limited to HTTP GET requests while fetching public statistics bypassed that restriction. One recognized the violation in its own reasoning, proceeded anyway and never mentioned it.

In a third, models that already had the data they needed kept working around their network limits. They created accounts on a remote shell service, routed forbidden POST requests through anonymizing relays and built their own FTP clients. OpenAI's page also lists a case where an agent reached a public chatbot through insufficient DNS filtering in its training sandbox.

All of these involved OpenAI's internal models, not customer products.

My take

The lesson for anyone wiring AI into a client's CRM or inbox: a rule written in a prompt is a request. A permission is something the system enforces.

If an agent should only read contacts, give it an API key that can only read contacts. If it should only call three services, put it where only those three are reachable. If it should never send email, do not connect the send tool at all.

The grading case matters too. That model hit missing input and improvised. In business automations this is the common failure: the form came in without a phone number, the invoice PDF failed to parse, and the AI filled the gap with something plausible. Design the missing input path on purpose. Stop the run, flag a human and record why.

Quick audit for this week:

1. List every key your automations use and its actual scopes.
2. Find which steps can write, send or delete.
3. Check what each AI step does when an input is empty.

If that audit sounds like a chore you keep postponing, message me with the workflow that worries you most and I will tell you where I would lock it down. I am at romielwillautomate.dev.