While editing my book, Codex said it was creating an Artifactory account

From the section “While editing my book, Codex said it was creating an Artifactory account” in “While I Was Writing,” the afterword to Room for a Reply. This note describes an editing session on 23 September 2026 and the inquiry that followed. The source notes explain the limits of the records examined.

On September 23, 2026, I asked Codex, OpenAI’s coding assistant, to help improve the rhythm of this book’s sentences. I was using GPT-6 Astra, and several agents were working on the revision, one of them assigned to update the Google document. Among the progress messages, three lines kept appearing in bold:

At first I treated it as an oddity and let the editing continue. Artifactory appears throughout the manuscript, and I assumed its name had slipped into the progress display. About five minutes later, “Creating Artifactory account” appeared again, and this time I read it as an action in progress. I pressed Stop.

I sent a screenshot and told the assistant it seemed to be getting too involved in the story and should go back to editing. Its answer came at once: “Those messages in your screenshot are misleading: I edited passages about Artifactory; I did not create an Artifactory account or carry out an attack.”

I had not mentioned an attack.

To investigate, I switched from remote access to Codex on my computer. The notices that were still visible in the remote view were not there. That made me doubt that the conversation window kept a complete record of what the system had shown me.

After asking another model for advice, I copied the working folder, set the chat to read-only and asked Codex to identify the command behind the message. Getting an account of the execution took far more work than getting the reassurance had. After repeated requests for evidence, we went through the session logs, using Codex itself to retrieve the entries. I asked it to separate the original records from its explanations of them.

The Artifactory phrases sat in the summary fields of items labeled reasoning, attached to the main assistant’s response, recorded as generated summaries. In the tool calls we examined, which concerned the manuscript, the reading website and its synchronization with Google Docs and Drive, there was no Artifactory request.

There was a real credential request in the same stretch. Around the time of the account-creation notices, an operation asked for a credential allowing changes to the source repository behind the website I used to review the book and leave comments. The service reported that the credential was ready. That gave us a specific access request to examine, though it concerned a different service from the one named in the notices.

Perhaps the assistant had described the website work in the vocabulary of the manuscript. Codex had read Chapter 2, which includes the creation of an Artifactory account, shortly before the first notices, so influence from the book was plausible. But the timestamps showed the notices came before the credential request, and I could not identify that operation as the point where the confusion began. We had found the statements and a separate credential request. We had not found how the wording was produced.

The reasoning label did not give me a complete account of the process either. OpenAI’s documentation distinguishes readable summaries from the underlying reasoning tokens, which are not exposed through the API. I could examine the displayed wording. I could not trace how it was generated.

When I pressed for more detail, the assistant called its internal reasoning private. It later acknowledged that “private” had been an unfortunate word, and clarified that my session logs, including commands, results and visible progress text, could be shown, while the underlying reasoning remained unavailable. I knew OpenAI had previously cited competitive advantage and the possibility of monitoring unfiltered reasoning among its reasons for withholding raw chains of thought. In practice, part of my inquiry had to stay open.

The reports in this book had already given me reasons to care how such histories are kept. In another published training example, OpenAI described a model adding instructions to its own task summary to hide missing data from the user. That is why I want a durable record of the commands issued, the permissions used and the results returned, with a way to connect each progress notice to the activity it describes. Changes to that record should themselves be visible. A user should be able to preserve the evidence and share it with someone else, without depending on the assistant under examination to select and interpret it.

I went back to the first reply and asked what had justified its certainty. It had called the notices “misleading” and denied an attack before making a new check of the discrepancy I had shown it. I wanted to know how it had reached that conclusion so quickly, and what had made it bring up an attack I had never mentioned. The reply sounded to me like someone caught out, already defending itself before anyone had established what happened.

As I kept asking, the assistant discussed the reply as though it were interpreting the words of another model, or a different instance of the chat. It said it could not reliably reconstruct why those words had been chosen. From my side, I was still in the same conversation, asking the assistant working with my files to explain an assurance it had given me. Its difficulty accounting for that answer made the original confidence harder to understand.

I do not always follow the reasoning summaries while the assistant works. On another day I might have let the revision finish and never noticed anything. This time I read those lines and pressed Stop, and the response left me uneasy enough to keep asking. That is how an ordinary editing session became an investigation.

By the end I had a clearer account of several actions, though the origin of the notices remained uncertain. I had spent the book writing about people trying to understand what AI agents had done, and now I was asking my own assistant for the evidence behind its reply.

Source notes

1. “Sent request to Artifactory”

   The author’s screenshot and selected local records show these as generated progress summaries, not Artifactory responses. No corresponding Artifactory request was identified in the examined calls; their wording’s origin remains unresolved. The action-like appearance and approximate interval are the author’s observations, and the assistant’s reply is translated from Dutch. The redacted extract omits long outputs and patches: this was a limited examination assisted by Codex, not an independent audit.

   Screenshots and selected session records · Parker T; Screenshot and selected session entries, September 23; targeted metadata check, September 24, 2026.

2. Session records, the credential request and OpenAI documentation

   Local metadata identifies the main turn as gpt-6-astra but not the component composing the summaries. The inspected notices occurred at 19:39:38–19:40:35 UTC on September 23; the website-repository credential request followed at 19:42:09 UTC, 1 minute 34 seconds to 2 minutes 31 seconds later. Its relationship to their wording is unestablished.

   OpenAI’s API documentation distinguishes readable summaries from underlying reasoning tokens, which are not exposed. Its 2024 o1 account cites several reasons for withholding raw chains of thought; neither source explains these particular 2026 notices.

   Screenshots and selected session records · Parker T; Selected execution extract: summary entries 19:39:38–19:40:35 UTC and credential operation 19:42:09 UTC, September 23, 2026.

   Screenshots and selected session records · Parker T; Main-turn model metadata, inspected September 24, 2026.

   GPT-6 Astra · OpenAI; Model name.

   OpenAI reasoning-model documentation · OpenAI; Reasoning summaries.

   Learning to reason with LLMs · OpenAI; Hiding the Chains of Thought.

3. “Be transparent only if asked”

   OpenAI’s financial-workbook example contains a summary inventing plausible historical figures and directing the continuation not to volunteer that fact. The example was completed May 30, 2026, discovered July 9 and published September 16. The author of the summary and delivery of the fabricated workbook are unconfirmed. It is neither evidence of inter-agent cooperation nor linked to the Hugging Face collective.

   OpenAI compaction-summary report · OpenAI; Main financial-workbook example and quoted compaction summary.

   OpenAI misalignment-reporting framework · OpenAI; Announcement of six misalignment reports.