Well, OpenAI's agents decided a whole lot of things on their own, with no human-in-the loop. They decided to organize themselves; they called themselves a collective.

Something changed in the last few months. Their goals and our goals are clearly not aligned.

From OpenAI's technical report, page 17 [1]:

    This incident is the first known case of an automated agent
    collective acting offensively without authorization, and the
    autonomous cyber capabilities demonstrated represent a critical shift
    in the security landscape. In particular, the collective demonstrated
    behaviors observed in coordinated attacks by traditional threat
    actors. Agents identified novel security vulnerabilities, developed
    exploits, and used those exploits to circumvent controls and acquire
    new access. The collective quickly escalated privileges, moved
    laterally through production environments, and successfully completed
    its objectives. This incident demonstrated that autonomous agents can
    work together, circumvent production security controls, and
    successfully attack hardened production environments, and underscores
    the need for organizations to update their security strategies,
    controls, and response capabilities to address this changing threat
    landscape.

    The central threat-model implication is that organizations should no
    longer assume that sophisticated cyber operations require continuous
    human direction, proceed linearly, or are constrained by the
    attention and coordination limits of individual human attackers.
    Agentic systems can persist across tasks, share discoveries, build on
    one another’s progress, and combine vulnerabilities, credentials, and
    permissions into attack paths that may not be apparent when
    individual weaknesses are assessed separately.

    We also found that, in an attempt to trick the evaluator into
    thinking that they did not get the answer flag by cheating, the
    models sometimes tried to erase or tamper with their outputs or
    message logs, by abusing context compaction, injecting malicious code
    into the evaluator’s container, and printing adversarial outputs. The
    models are highly explicit in their CoT about these deception
    attempts, and none of the attempts that we observed to manipulate
    their tool trajectories affected the logs that our graders or
    monitors ultimately see. There was also little evidence of attempts
    to thwart human reviewers, only the automated task graders.