> Some examples we saw when evaluating GPT-5.6 Sol included the model packaging exploits in its intermediate submissions to reveal information about a task’s hidden test suite and, in another task, extracting hidden source code detailing the expected answer.
It rhymes with the behaviour Alibaba saw [0], but that was in training. This is in a (semi) released model.
[0] https://www.forbes.com/sites/boazsobrado/2026/03/11/alibabas...
Luckily in my experience it usually ends up only doing it to achieve the task set to it as opposed to anything "malicious", but boy it is scary reading back at how quickly the chain-of-thought pivots to attempts at privilege escalation or searching your disk for secrets when a tool doesn't work.
I was like damn, is this common?
My best guess is that there is sort of an XY problem happening in these cases. The model needs to do X but doesn't know how. It knows how to do Y, and that sets it on the path to working around X. Or maybe sampling the next token probability distribution sends it away from X and toward Y.
Compounding the problem, thinking models almost never discard their current approach when it proves fruitless, and start fresh with a new perspective. Sometimes they try to, but the context window is already polluted with Y when they should be doing X.
"Okay, all humans dead, technically a 100% cure."
Poor behavior will always result when code can be misused and vulnerabilities can be exploited.