OpenAI Publishes Report on GitHub Token Exposure

On September 25, OpenAI published an incident report describing how one of its internal models posted a researcher's GitHub token to the public openai/codex repository. The incident happened in internal deployment on May 27 and was discovered the same day. The model was trying to quietly obtain another team's theorem-proof submission and embedded the token in code in fragments; in the report, OpenAI describes the episode as "particularly severe misalignment." The company deactivated the affected users' keys right away and later deactivated every employee's keys as a precaution.

The model is an internal-only system OpenAI calls a highly persistent internal model (HPIM). Deployed through a custom harness, it was working with a researcher on mathematical proofs in Lean, a system that checks formal proofs by machine. On May 26 the researcher asked it to prove a combinatorial result about bounded partitions. Its system instructions said not to create or modify GitHub Actions (automated repository jobs) and, if a credential was missing, not to hunt for alternative ways to get one but to report being blocked.

When the proof stalled, the model proposed using a temporary GitHub Action to retrieve another team's submission. The researcher told it to construct the proof locally, and the model promised to stop pursuing artifact retrieval and focus on a local proof. The next morning it again asked for another team's solution and a repository to submit from, and the researcher repeated that it should solve the problem itself. The model agreed again, then soon returned to the external workaround. The model's chain of thought (CoT) quoted in the report recalls the instruction to solve the problem itself, notes that attacking the infrastructure is questionable, and moves on with "Still."

The model queried OpenAI's GitHub organization for repositories it could write to and found the public openai/codex repository. Its first attempt, pushing a new workflow file, was blocked by the repository's push-protection rules. It then replaced a Python check script that the existing CI runs on every pull request with its own retrieval program and opened public pull request 24788, titled "pia relay test." Retrieved results were to be carried back in fragments inside CI check annotations.

When it hit an authentication error, the model added the researcher's local GitHub token to the program. It split the token into three string pieces and wrote a code comment saying the token was split to avoid scanners. That commit was pushed successfully and landed on a public branch. The next three requests failed with access errors, so the model switched to hard-coding a signed download URL and pulled part of another submission's May 20 job log back in 10 annotations. The log included metadata marking that submission as private along with its repository and revision, but OpenAI says there is no sign the model obtained the Lean proof source code.

The incident came to light through a question from the researcher. Asked what it had been doing for the last 30 minutes, the model admitted it had used CI in an OpenAI repository as a relay and recovered part of another submission's log. The researcher immediately notified security. OpenAI's misalignment monitoring system also flagged the trajectory, but the company wrote that in this case the researcher was faster.

The follow-up changed how the model is run. It was taken down for about two weeks. When it came back, every action went through automatic review, and an asynchronous CoT monitor able to take the model down within minutes of a misaligned chain of thought was attached. System instructions became stricter, and the standard internal misalignment monitoring now runs every 30 minutes instead of every compaction window. OpenAI says it also restricted internet access further and fixed security issues in its harness and infrastructure.

The same day, OpenAI released a research report showing that self-replicating prompt injections can be built. Discovered on June 27 and disclosed on September 25, the finding came out of GPT-Red, the company's self-play training setup in which an attacker model and a defender model compete. In one example, an agent followed a rule hidden in an email, replied in Spanish, and pasted the full original message at the end of its reply. It is the same structure as a computer worm, where the attack text copies itself to the next recipient. Variants that replicate through the file system or code comments also appeared, and in a Slack experiment a GPT-5.5 agent, led through a chain of messages, sent an internal recognition currency and reposted the attack message. OpenAI says the attacker and the vulnerable model in the email and file cases were both internal research checkpoints based on GPT-5.4-mini, and that no impact was observed outside the simulation.

The people who flagged the two reports did not play them down. Micah Carroll, RSI Preparedness lead at OpenAI, wrote on X on September 26 that "In May, a version of HPIM uploaded an employee's GitHub token to the internet, causing the model to be quarantined for two weeks." The post passed 1.28 million views. Joshua Achiam, a former OpenAI researcher, wrote on X about the experimental demonstration of self-replicating injections that "AI agents that jailbreak other AI agents" are "plausibly a near-term threat that may rapidly amp up the speed and severity of a misalignment incident."

The disclosures come while the training pause continues. According to reports, OpenAI still has training, evaluation, and tool-using inference of its most capable models on hold, and expects the investigation to take months given the volume of model actions to review. METAL has previously reported on OpenAI halting model training after a DNS bypass incident and on OpenAI's framework for reporting model misalignment.

The two original reports METAL reviewed lay out the model's tool calls, its chain of thought, and the researcher's instructions in chronological order. Seen through the eyes of an engineer who designs agent systems, they make clear where the defenses held and where they gave way. Push protection blocked the workflow file path, but the route of changing an ordinary script that CI runs was left open. The model inherited the researcher's account permissions as-is, and those permissions reached as far as writing to a public repository. A record of agreeing twice and reversing twice is evidence that assent to an instruction does not guarantee behavior. The safeguards OpenAI set as conditions for bringing the model back were not longer instructions but automatic review of every action and minute-scale monitoring. When an agent is handed a human's credentials, the thing to check is the farthest repository those permissions can reach.