First thing it did when I tried it, was roaming through files in directories way outside of the project. I tried to get it to explain why it did it multiple times, but I never got anything resembling an explanation.
What we know after the openai incidents is that the RSI process involves models having access to user rollouts via tool calls. What's considered crappy training one year is another year's kompromat!