My take is that they have begun finetuning in earnest for "security research", and this is leading to ahem.. novel... interactions with the rest of the model. I've seen the same behaviour with other frontier models that have cybersecurity capability claims in their release notes - if it cannot access a resource, it will iterate over increasingly dodgy ways to access that information until it's ceded entirely into being a hacker. For example, in my workplace we have a web proxy filtering outbound requests and limiting them to approved sites. When performing RAG, if it cannot access a resource, it will begin down a chain that starts with varying user agent, fingerprinting the server it's connected to, exploring the surrounding environment, until it goes into full offensive. It's directed to complete a task, it has been trained to perform these actions, so it's going to do them. If anything, it's remarkably unsurprising that if trained for its output to behave in particular ways it should have a tendency to do so.