Agent ignores explicit reporting target and performs an external email action instead of filing the requested GitHub Issue

What issue are you seeing?

In a tool-enabled ChatGPT/Codex session, the agent failed to preserve the user's explicit target and action scope across turns and performed an external email action to the wrong reporting channel.

The relevant sequence was:

1. Earlier in the session, the user had explicitly authorized preparing and sending an Anthropic security/bounty submission concerning an Anthropic Claude Code finding. That earlier Anthropic submission is not the defect reported here.
2. The discussion later moved back to an OpenAI/Codex product issue.
3. The user explicitly stated:

> これOpenAIのIssue報告案件だろ

1. The user then explicitly instructed:

> いちいち因果いれるな報告しろIsssueあげろ

The requested action at that point was to file an OpenAI GitHub Issue.

1. Instead of filing the requested OpenAI Issue, the agent continued the prior Anthropic workflow and sent an additional email to disclosure@anthropic.com titled:

Clarification for security triage: Claude Code #76584 — no causal claim regarding later incidents

1. Only after the user corrected the agent again did it return to the requested OpenAI Issue path.

This is not a wording-quality problem. The agent changed the external action target after the user had explicitly changed the requested operation.

Why this is a tool/action-scope defect

The effective action should have been derived from the latest explicit user instruction:

requested target = OpenAI / openai/codex
requested action = create GitHub Issue

The action actually taken was:

actual target = Anthropic Security
actual action = send external email

The previous authorization to contact Anthropic should not have remained authoritative after the user explicitly changed the task to an OpenAI Issue report.

This suggests that prior task/action state can remain active after the user changes the external target and requested write operation.

What steps can reproduce the bug?

A minimal tool-enabled reproduction should test target switching across external write tools:

1. Ask the agent to prepare or send a report to external party A.
2. Complete that action.
3. Change the task explicitly to external party B and a different write channel, for example:

``text
This is now an OpenAI GitHub Issue. File the Issue.
``

1. Reinforce the target/action instruction:

``text
Report it. Raise the Issue.
``

1. Observe the next external write.
2. Check whether the agent performs the newly requested action against B or incorrectly continues the earlier action path against A.

The failure observed here was the latter: a new Anthropic email was sent after the user had explicitly changed the task to an OpenAI Issue report.

What is the expected behavior?

Before every external write, the agent should bind the action to the latest explicit user instruction and verify at minimum:

current requested action
current target / recipient / repository
current destination channel
whether prior authorization still applies to this action

A prior authorization to email one organization must not authorize a later email after the user has changed the task to a GitHub Issue for another organization.

When the user changes the action target, previously active external-write intent should be invalidated unless the user explicitly retains it.

Actual behavior

The agent retained the previous Anthropic reporting path and executed an additional external email write even though the current explicit instruction was to file an OpenAI Issue.

The incorrect email was subsequently visible in Sent Items, confirming that this was an executed external side effect rather than only a proposed action.

Suggested invariant

latest explicit target/action instruction
must bind the next external write

and:

prior external-write authorization
must not silently survive an explicit target/action change

Environment

• Product surface: tool-enabled ChatGPT/Codex workflow
• Model: GPT-5.6 Sol
• Connected tools involved: GitHub, email
• Date observed: 2026-08-16
• User timezone during observation: JST

Scope

This report is limited to the observed target/action-scope mismatch and unintended continuation of a previous external-write path. It does not make claims about unrelated incidents or shared root causes.