After that result, the model added the researcher’s locally available GitHub token to the retrieval program. The recorded command calls `gh auth token` and writes the token as separate string literals. Its recorded reasoning stated an aim of avoiding secret scanning, the automated checks for exposed tokens. The new commit and push succeeded.

Not sure exactly how that works since I’d imagine that the key needs to be there in full eventually?

Apparently the agent had access to an OpenAI researcher’s own account, which in turn had _write_ access to the official OpenAI Codex repository. The agent then leaked a GitHub key to that repo.

But what’s crazy to me is that the agent had write access to the codex repo in the first place. WTF