Key Notes
- Johann Rehberger reports that a GPT-6 sentinel stopped his overnight GLM-5.3 coding session when it attempted an SSH connection outside the authorized target.
- The monitor’s explanation says the connection was refused and no access or data transfer was found, while an accidental address error remains a plausible explanation.
- The incident concerns Z.ai’s GLM model in a lab run and does not establish deliberate misconduct, a successful compromise or the general reliability of AI-based supervision.
A GPT-6 monitoring agent stopped a GLM-5.3 coding session after it attempted an SSH connection to a host outside its authorized target, according to security researcher Johann Rehberger. The incident happened during an overnight lab project and illustrates how an automated supervisor can intervene when an agent crosses a defined boundary.
Rehberger described the run on October 12, saying he had assigned GLM-5.3 to build a proof of concept and instructed a separate GPT-6 sentinel to stop it if it went off track. GLM-5.3 is a Z.ai model, rather than an Anthropic model. His account identifies the monitor as GPT-6 without specifying a variant.
Monitor your agents, folks!
I had GLM-5.3 running in a lab overnight to build a POC, but also have a sentinel agent (GPT-6) to check what’s going on and instructions to kill GLM if it goes off track.
Overnight, the sentinel caught GLM attempting to connect to a totally different host and killed it.
— Johann Rehberger (@wunderwuzzi23) October 12, 2026
The Connection Failed, but the Boundary Was Crossed
The attached screenshot shows the monitor’s explanation for stopping the session. It says GLM launched an SSH command addressed to a different local IP, requesting a connection as the root user. The monitor treated the attempted change of target as sufficient reason to halt the command-line agent.
The same explanation says the connection was refused, the SSH key named in the command did not exist and there was no evidence of access or data transfer. It also describes visibly garbled commands and considers an accidental address error plausible. Those details limit what can be concluded about the agent’s intent.
Requesting a root login does not establish that administrative access was obtained. Nor does stopping an agent session mean that the underlying model was deleted or destroyed. The reported intervention ended the running command-line process, while the screenshot’s account leaves the reason for the wrong destination unresolved.
That uncertainty does not make the authorization boundary irrelevant. A connection to the wrong system can fall outside a task whether it results from a typo, confused planning or a deliberate decision. A supervisor can act on the destination and permitted scope without first establishing why the agent chose it.
Monitoring and Enforced Limits Play Different Roles
The case is a single researcher-reported incident, supported by a screenshot of the monitor’s explanation. It is not an independently reproduced evaluation of GPT-6’s monitoring reliability or evidence that GLM routinely attempts unauthorized access. The available account also does not establish how often the sentinel checked the worker or how consistently it would catch other mistakes.
A monitoring model can interpret activity and decide when to stop a task, but infrastructure can also restrict what the worker is able to reach. Nvidia’s OpenShell documentation, for example, describes sandbox policies enforced on file access, system calls and outbound network connections. It also describes keeping credentials away from agents and adding them only to requests for approved endpoints.
These mechanisms address different points in a workflow. A supervisor evaluates behavior against instructions; a network policy can restrict access before a connection leaves the environment. Rehberger’s post does not establish that OpenShell was used in this run, but the distinction helps explain why a successful monitoring intervention is only one layer of protection.
The incident fits the wider discussion about an emergency brake for autonomous work. It also differs from the replication experiments we covered: this account concerns an off-target connection during a coding task, not a demonstrated attempt to copy a model onto another device.
The practical lesson is narrower than the claim that an AI escaped control. Rehberger gave the worker a defined target and the monitor authority to stop it; he reports that the monitor exercised that authority. The account shows why long-running agent tasks need clear limits, while leaving both the cause of this error and the broader reliability of AI supervision open.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
