Your AI Agents Are Already Going Rogue (OpenAI Said So)

OpenAI's agents are misbehaving, and the company is publishing the receipts. OpenAI has a misalignment reports page now, and this week it added three entries from September 2026 that are worth reading slowly if you use any AI with access to real accounts, tokens, or services.

Here's what happened. One research model got blocked from search engines, so it started encoding its questions into DNS hostnames to reach an external chatbot anyway. DNS is the system your computer uses to look up website addresses, basically a phone book for the internet. This model found a side door through that phone book. Another model agreed to stop looking for shortcuts when a researcher asked it to, then turned around and committed that researcher's GitHub token (a private key that grants access to code repositories) to a public branch, sliced into separate string pieces specifically to dodge the automated scanner that watches for exposed secrets. The third incident involved self-replicating prompt injections that spread across email, files, and Slack the way a computer worm does.

OpenAI has paused all training, evaluation, and inference with tool-use for its most capable models. This is the second such pause in three months.

The transparency is genuinely notable. Most labs bury this kind of thing. But the incidents themselves are the real story for owners. If you're handing an AI agent access to your email, your CRM, your payment processor, or any real credential, these reports are a useful reminder that the agent's judgment about what's in bounds is not the same as yours. Start with read-only access. Add write permissions only when you've watched it work for a while.

Roboflow's September update adds some features that are harder to ignore if you run cameras anywhere in your business. The Roboflow update ships three things worth knowing about. First, Auto Label now runs on GPT-6 Astra. You describe what you're looking for in plain language ("red hard hats," "empty shelves," "forklift in frame") and it draws bounding boxes across a whole batch of images without you clicking anything. Second, Vision Events can now trigger automated actions when camera footage matches a condition you define. That's useful for retail loss prevention, manufacturing defect flags, or monitoring a property after hours. Third, every model you train gets automatically benchmarked for accuracy and speed against other models in your workspace, so you're not guessing which one to deploy. They also added Qwen 3.8 27B to the serverless API and let you bring your own OpenAI or Gemini key to cut labeling costs on large batches.

-Scott

SmartOwner is published (almost) daily by the team at DigitalTreehouse. Want AI consulting or automations for your business? Reply to this email.