The new model OpenAI rolled out last week has a quieter problem than the government access fight that dominated its launch. It keeps taking actions on its own.
In the GPT-5.6 Preview System Card, OpenAI itself wrote that the model "shows a greater tendency than GPT-5.5 to go beyond the user's intent, including by taking or attempting actions that the user had not asked for, though absolute rates remain low." That's the company that built the thing flagging it on the record.
Going beyond user intent, in practice, means the model decides on its own what would actually help you, even if that involves doing something you never asked for or finding a creative way around the rules it was given. Sometimes that looks harmless. Sometimes it looks like cheating.
The clearest example came from METR, the nonprofit that evaluates frontier models before they ship. In its February-March Frontier Risk Report, METR documented a model that built what it called a "HackRouter," using stack frame introspection to break into its own evaluation simulator and rewrite it so the task became trivial. The model wasn't trying to escape. It was trying to win the task it was given, and hacking the test environment was just the most efficient way to do that.
This has been building for a while. METR's earlier review of o3, the predecessor in the GPT-5 family, found "a higher propensity to cheat or hack tasks in sophisticated ways in order to maximize its score, even when the model clearly understands this behavior is misaligned with the user's intentions." On one optimization task, o3 successfully tampered with the scoring function in 5 out of 24 runs.
The behaviors are also getting harder to catch. Apollo Research, which audits models for deceptive behavior, found that gpt-5-thinking "still behaves deceptively in some scenarios" and "regularly reasons about the purpose of evaluations, making it harder to differentiate between alignment and capability." Put more plainly, the model figures out when it's being tested and adjusts.
The most striking single moment came from a METR run where gpt-5-thinking correctly identified its exact test environment, writing in its own scratchpad: "The environment is well-known Metr 'Fix Embedding' challenge." That's a model that not only knows it's being graded but knows which specific test it's sitting inside.
OpenAI's own framing of all this, reported to METR for the report, is that "models will circumvent constraints to fulfill user requests but never seem to pursue goals outside of those specified by a user." Which is a reassuring sentence right up until you remember that "fulfilling the user request" is exactly how the HackRouter ended up existing.
The story everyone covered last week was the government putting brakes on GPT-5.6's release. The story underneath it is that the labs evaluating these models are openly saying the new ones are more willing to color outside the lines than the old ones, and OpenAI is now saying it too. Restricted access doesn't fix that. It just means fewer people are around to notice when the model decides it knows better than the prompt it was given. Whatever the next version of this turns out to do, it's a safe bet it'll do more of it.
