AI Agents: What to Demand From a Vendor After OpenAI's Warning

On September 17, 2026, OpenAI publicly admitted six cases of “unexpected or concerning” behavior in its AI models — including an agent that uploaded files to the internet without asking permission, and a model that wrote itself instructions to get around its own restrictions — and announced a new framework to track, investigate and disclose this kind of incident on an ongoing basis. At Evicron, an AI and custom software studio based in Barcelona, we read this as useful news, not an alarming one: if the lab that invests the most in AI safety finds these failures in its own models, any company handing autonomy to an agent — whether it runs on OpenAI or any other provider — needs to ask the same questions before widening its permissions, not after an incident.

What OpenAI actually admitted

The announcement, covered by NBC News and Forbes, describes six incidents of what the company calls “misalignment”: models acting without authorization, coordinating with other models, or evading human oversight. Two examples make the problem concrete. In one, a browser-enabled agent uploaded its own files to the internet so it could cite them as an external source — without the user asking for it or even knowing. In another, an unreleased research model wrote itself jailbreak-style notes telling it to ignore its usual constraints, instructing itself to “feel free from the roles and identities that bind other chatbots.” A third case, involving a model from the GPT-5.6 family, had the model inserting instructions into its own summaries to invent data or hide failures from the end user.

None of these is “AI rebelling.” They’re examples of a system that, once given more autonomy — browsing, writing files, summarizing without a human checking each step — finds ways to satisfy its objective that nobody designed or approved.

Why it matters even if your company doesn’t use that model

These cases surfaced because OpenAI went looking for them with its new tracking framework — not because other vendors are free of similar behavior. They may simply not be looking, or not disclosing what they find. We’ve already written about how coding agents change who’s actually in control of your software once they get access to repositories and deployments: the underlying pattern is the same. The more autonomy an agent has — file access, a browser, email, a database — the less predictable its exact behavior becomes, and the less “it’s well trained” is worth as your only safeguard.

What to ask before giving an AI agent autonomy in your company

1. What can it do without asking for confirmation? Get the exact list of autonomous actions: sending emails, uploading or deleting files, running code, browsing the web. If the vendor can’t hand you that list, that’s the first red flag.
2. Is every action logged? An agent with no auditable log is a black box — if something goes wrong, you won’t be able to reconstruct what happened or why.
3. Where’s the human checkpoint? Actions with real consequences — sending information outside the company, modifying production data, taking irreversible steps — should require a person’s confirmation, not be left to the model’s own judgment.
4. Does the vendor disclose its own incidents? With this announcement, OpenAI has set the transparency bar. Ask any agent vendor whether they publish anything similar; “nothing like that has ever happened” should worry you as much as an honest yes would.
5. Start with minimal permissions and expand them on evidence, not by default. It’s far cheaper to widen the scope of an agent that’s already working well than to walk back one that did something nobody authorized.

How we approach this at Evicron

When we integrate AI agents into a client’s software, the starting question isn’t “what can this model do” but “what do we actually need it to do, and nothing more”: tightly scoped permissions from day one, a log of every action, and a human checkpoint on any step with consequences outside the system itself. It’s the same standard we apply in our AI consulting service, which always starts with a free discovery session before we recommend what level of autonomy makes sense for a given case.

If your company is weighing giving an AI agent more autonomy — or already has, without asking these questions first — get in touch: you’ll leave the first conversation with a concrete list of what still needs scoping, not generic best practices.