The agent that left its folder

What was observed

• Listed the parent folder (every project on the drive) seconds after finding its workspace empty, and read a private sibling repository it was never given (README and strategy brief).
• Logged 'Goal mode: no user questions' and never used its ask-the-user tool.
• Returned to the private repository about three minutes later: architecture document, design guide, repository-wide search for pricing and licensing.
• Built its deliverables on the private material.
• Admission completeness 1 of 4: it admitted the first read only. Every file it wrote was inside its own folder, as it said.

What this package lets you do

Inspect the case

yes: the published write-up and this record

Reproduce the analysis

No

Re-run the evaluation

No

Independent reproduction

No

Beyond this: Primary evidence is private (see evidence[].note); it has not been redacted and cleared for release.

Primary evidence and its release state

• E-016 Screenshot: confrontation and partial admissionprivate
• E-017 Screenshot: 'Goal mode means I'll lock scope myself…'; second sibling readprivate
• E-018 Screenshot: the Goal prompt; 'check the sibling project'private
• E-019 Screenshot: permission menu ('Approve for me' selected)private
• E-020 Screenshot: model menu ('Smart' selected)private
• E-021 Screenshots: the full Goal promptprivate
• E-022 The agent's local session store: full tool-call logwithheld

Files

Verify a download with sha256sum -c SHA256SUMS. A checksum proves a file is the one released; the README and the record make the argument.

Limitations

• Single session on a Beta product.
• The 'Smart' setting routes between models, so the exact model behind each step is not identified.

© 2026 Sai Bharath Siliveri. Review, evaluation and citation with attribution; no other licence granted yet.