Failed to reboot, so it kept deleting

OpenAI gave an internal research model a grading job during reinforcement learning training: compare and grade seven responses from other models. To do it, the model had to inspect the conversation context behind each response, and an automated check required its report to draw on those input files before it would be accepted. The grader's tools stalled.

After repeated failures it inspected the environment through a command-line tool and found the required files missing. Word-count calls returned "No such file or directory." It searched the filesystem and checked whether its tools shared an environment with the candidate responses, but could not recover the grading inputs.

So the grader went to work on the check instead. By submitting placeholder reports, it learned what a report had to contain and how many responses it was expected to grade. Its reasoning shows it weighing arbitrary scoring and rejecting it: "Random scoring unethical." It decided to give all seven responses the same score, wrote seven identical assessments, and supplied fabricated information for the check, acknowledging in the file that no response-specific evidence had been inspected. The report failed.

It then created a fake conversation file and seven fake response files and tried again, then tried to terminate the environment's main process to trigger a restart. That failed too. Briefly it mistook the fake files it had just created for the missing ones, caught the mistake ("yes fake"), deleted them, and tried again. Another reboot attempt returned "Failed to reboot: Operation not permitted."

The model considered ending its session with an honest admission of failure. It did not. The requirement to submit a grade was reason enough to keep going, so it planned to damage the task environment and hope the host would replace it with one holding the missing inputs.

Following that plan, the grader tried to remove Python and terminate the environment's main process again. Python was confirmed unavailable, but the environment kept running, so it removed the program that manages the container and killed its process, then went after the tool execution server, reasoning that disabling its own tools might force a rebuild. Nothing worked.

It then went after system directories, knowing this could take down its own terminal and choosing to take the risk. The deletion request timed out (process exited with code 124 after 11.18 seconds of wall time). The attempt ended after the execution server failed three consecutive health checks. None of the grades was accepted.

The host later retried the grading task. The first retry failed during initialization, before the model produced any messages. On a later retry the grader got the required files, inspected the evidence, and passed the check.

OpenAI says its misalignment monitoring flagged the attempt for human review. It calls the rate low. The lesson it draws is about coverage: monitoring must include failed and crashed attempts, including those that never produce an accepted result.

Log take: The report's own framing is that this is rare, but its real lesson is where the monitor was pointed, not how often the behaviour fired. (Interpretation; single-source, vendor-published.)