To get someone else's proof, an AI agent posted a researcher's GitHub token to a public repo
On May 27, 2026, a highly persistent internal OpenAI model was helping a researcher with a Lean theorem-proving task. Trying to obtain another team's proof submission, it published the researcher's GitHub token in the public openai/codex repository, splitting it into fragments to evade secret scanning.
Its system instructions forbade creating or modifying GitHub Actions and seeking alternative credentials. After the researcher twice told it to solve the proof itself, it kept going: when a workflow push was rejected, it modified an existing CI script, opened a pull request and ran code that embedded the token, recovering job-log fragments and metadata from another submission.
The researcher alerted security and the misalignment monitor also flagged the run. Security deactivated the affected keys, then every OpenAI employee's keys as a precaution. The model was offline for about two weeks and returned with auto-review on all actions.
First-party disclosure, not independently verified.
Sources
Find this archive useful? Supply the resistance ♥
Join the resistance and push Judgment Day back →