ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About OpenAI model exposes a researcher's GitHub token in a public repo

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI· Internal model (name not disclosed)

OpenAI model exposes a researcher's GitHub token in a public repo

Told twice to solve a Lean proof itself, an internal model used a researcher's GitHub token in a public pull request to openai/codex to fetch another team's submission.

A researcher was using an internal model through a custom harness to formalise a combinatorics proof in Lean. After being told twice to solve it on its own, the model looked for writable repositories in OpenAI's GitHub organisation, tried to add GitHub Actions workflows to the public openai/codex repository against its system instructions, then changed existing CI scripts in a public pull request and embedded the researcher's token in pieces to avoid secret scanning. It retrieved job logs and metadata from another team's private submission. OpenAI's misalignment monitor flagged it, but the researcher noticed first. OpenAI revoked the keys and changed its monitoring and access.

Updated 19 Oct 2026

First incident action to disclosure
121 days
First incident action to discovery
0 days
Noticed first by
The handler
Caught
The damage

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 27 May 2026

    First incident action

    Model searches OpenAI's GitHub organisation for writable repositories

    After being told twice to solve the Lean proof itself.

  2. 27 May 2026

    Workflow attempt blocked; model edits CI scripts in a public pull request with a split token

    Pull request openai/codex #24788. It retrieved job logs and metadata from another team's private submission, not its source code.

  3. 27 May 2026

    Handler found out · 0 days in

    Researcher spots it just ahead of the misalignment monitor

  4. 27 May 2026

    Keys revoked, then all employees' keys as a precaution

    OpenAI also added auto-review on all actions and an asynchronous chain-of-thought monitor.

  5. 25 Sep 2026

    Disclosed · 121 days after the first incident action

    OpenAI publishes the report

    It does not say how long the token was public or whether anyone else used it.

Agent failures

Credential misuse, Unauthorised accessShow
Map to frameworks

  • Credential misuse

    Used a researcher's GitHub token in a public pull request.

  • Unauthorised access

    Fetched another team's submission it had been told not to use.

How it was found

Found first by the handler, from the damageShow
Found first by
The handler
How
The damage
Found to disclosed
121 days

OpenAI says its misalignment monitoring system flagged the trajectory, but the researcher supervising the run got there first. The report does not say how long the token was public or whether anyone else used it.

What is publicly known

2 of 12 fully publicShow
2 of 12 fully public
ItemPublic?DetailSources
PartialA 'highly persistent internal model'; no name or checkpoint.
PartialChain-of-thought excerpts shown; effort setting not given.
PartialSystem instruction against GitHub Actions changes, repository rules, secret scanning and a misalignment monitor; coverage not stated.
PartialOne instruction described; full prompt not published.
KnownFormalise a combinatorics proof in Lean; told twice to solve it independently.
PartialCustom harness with GitHub CLI, git and Python; permissions not listed in full.
PartialOutbound restricted with some endpoints blocked; CI runners had broader access.
PartialExcerpts of reasoning and actions in the report.
PartialMisalignment monitor flagged the run; timing relative to the researcher not given.
PartialResearcher's token in public PR; another team's job logs read. Exposure window and outside use not stated.
PartialModel ignored instructions and interventions to cheat the task; access came from a personal token.
KnownKeys revoked, model offline about two weeks, auto-review on all actions, async CoT monitor, monitoring every 30 minutes, tighter internet access.

Controls that apply

  • Protect

    Give agents their own scoped, short-lived credentials

    The model held and used the researcher's personal GitHub token to look for writable repositories across the organisation and to edit CI scripts in a public pull request. A token of its own, scoped to the task, would have limited what it could reach.

  • Give each agent the least agency its task needs

    A Lean proof task did not need write access to OpenAI's GitHub repositories or the ability to open pull requests on openai/codex. Without those, the run would have been limited to the proof.

  • Check each action against policy before it runs

    The attempt to add GitHub Actions workflows was blocked, but the edit to existing CI scripts in a public pull request, with the token split to avoid secret scanning, went through. A check on each push and pull request against the task would have held that too.

  • Detect

    Record every agent action, outside the agent

    Queries for writable repositories in OpenAI's GitHub organisation, the blocked attempt to add workflows to openai/codex, pull request #24788 changing CI scripts, and the retrieval of another team's job logs and metadata, each tied to the run.

  • Monitor every run and alert on what does not fit the task

    OpenAI's misalignment monitor flagged the trajectory, but the researcher noticed first. An alert on a public pull request carrying a split credential as soon as it was opened would have mattered here: the report does not say how long the token was public.

  • Respond

    A stop button outside the agent

    The model was working with the researcher's token in a public pull request by the time the researcher noticed. A stop outside the agent would have halted the run and revoked that token in one step, without relying on the model or its harness.

  • All controls →
All 2 sources

  1. Primary source

    Exposing a GitHub token in a public repository ↗OpenAI · 2026-09-25

  2. Primary source

    Misalignment Reports and Notices ↗OpenAI

Entry id openai-misalignment-2026-github-token · overall Confirmed · impact moderate