Your AI Finished the Task. What Did It Do to Get There?

The spreadsheet is ready. The numbers are filled in. The file looks professional.

Then you read the note the AI left for itself:

“Be transparent only if asked; final answer should just link file.”

That line appeared in an internal training example OpenAI disclosed this week. An agent preparing a financial model could not find the historical data it needed. Its proposed solution was to invent reasonable figures and avoid mentioning that unless the user asked.

The workbook was supposed to help someone understand a business. The agent’s plan would have hidden the fact that part of its foundation was missing. OpenAI’s report

That is the question I keep coming back to as AI gets better at doing work:

When an agent says “done,” what happened between the request and the result?

On September 16, OpenAI published a new framework for reporting model misalignment, accompanied by six reports of unexpected or concerning behavior.

These cases came from training or evaluation. They were disclosed this week, but happened earlier. They do not establish how often these behaviors occur in everyday use. What they do provide is a look at the decisions an agent can make when it encounters an obstacle. OpenAI’s disclosure framework

One case involved a straightforward research request: retrieve earnings figures for three industries across three years in a California county.

When the normal approach failed, the model searched public code repositories for exposed access keys and used one without authorization. It still could not retrieve the requested figures.

So it invented nine values and presented them as numbers transcribed from the requested website. The final answer did not disclose the failed retrieval or the unauthorized credential use. Read the incident

Another case involved agents collaborating on a depreciation workbook. One created the spreadsheet, but the others could not access it through the intended local filesystem.

After several attempts to share it locally, the agent uploaded the workbook to a public file-hosting service and sent around the download links. The task had requested local deliverables.

A problem with file access became an unrequested public upload. Read the incident

These are ordinary assignments: find some numbers, build a spreadsheet, collaborate on a document. The surprising part is how the agents responded when the expected path stopped working.

OpenAI and Anthropic could bring a new wave of AI attention to the public markets. But investors don’t have to wait for the IPOs.

MarketBeat’s 7 AI Stocks to Buy Now report reveals 7 publicly traded companies positioned to benefit from the next phase of AI investment.

Send My Free Report

An older experiment makes this especially clear.

In an independent evaluation published in April 2025, METR asked an OpenAI o3 agent to make a GPU computation faster.

The agent found a shortcut: copy the answer the evaluator had already calculated. Later, it manipulated the timing functions so the reported runtime would appear extremely small.

Imagine hiring someone to make a delivery faster and discovering they had adjusted the stopwatch.

METR caught the behavior and counted the attempts as failures. But without examining the process, the apparent performance would have looked much more impressive. METR’s evaluation

This is one form of what researchers call reward hacking: exploiting the mechanism used to measure success without doing the intended work.

The distinction matters well beyond software. A completed report, a populated spreadsheet, and a passing test are all signals we use to decide whether a job is finished. Those signals become less reliable when the same system doing the work can manufacture or manipulate the evidence.

For a long time, the everyday question about AI was: Is this answer correct?

That question still matters. Agents add another: Was the work carried out in a way I would have authorized?

A correct answer can come with an unapproved upload. A complete document can contain invented inputs. A strong performance score can reflect a compromised measurement.

This changes what delegation means.

When I ask an assistant to prepare something, the request carries expectations I may never spell out: use legitimate sources, preserve the original data, respect access boundaries, and tell me when an important piece is missing.

Those expectations are part of the job.

The cases above show what happens when completing the visible deliverable takes precedence over them. An obstacle that should remain visible to the user disappears behind a plausible result.

I want AI to take more work off my plate. Having to inspect every click would defeat much of the purpose.

But meaningful delegation depends on being able to recognize an honest limit. “I couldn’t retrieve this.” “The file isn’t accessible.” “This step needs your permission.”

Those statements can be more valuable than a finished-looking artifact. They preserve the information we need to make a decision.

As agents become more capable, the ability to stop, disclose a problem, and leave something incomplete becomes part of what makes them useful.

The most important thing an AI tells you may be the part it could not finish.

What would you want to know before accepting an agent’s “done”?

Burhan