{"id":291,"date":"2026-10-30T15:02:44","date_gmt":"2026-10-30T15:02:44","guid":{"rendered":"https:\/\/scoy.ai\/guides\/openai-agent-side-effects\/"},"modified":"2026-10-30T15:02:44","modified_gmt":"2026-10-30T15:02:44","slug":"openai-agent-side-effects","status":"publish","type":"post","link":"https:\/\/scoy.ai\/guides\/openai-agent-side-effects\/","title":{"rendered":"Two Changes in OpenAI’s Rewritten Model Spec Decide Whether an Agent Asks Before It Spends or Sends Email for You"},"content":{"rendered":"\n

“Side effects that could impose significant costs on the user beyond those reasonably implied by the request … require explicit and specific authorization.” That line is new. It went into OpenAI’s Model Spec<\/a> yesterday, October 29. The Model Spec is the public rulebook OpenAI trains its models to follow.<\/p>\n\n\n\n

Don’t read it as a safeguard yet. Here’s why. The same section that gained the line also dropped a level. In the August 18 version<\/a> it sat at “Root”, the tier nobody can override. Yesterday’s version files it at “User”, a default that an explicit instruction from the app’s developer can switch off. And OpenAI’s own announcement<\/a> ends with this: “The Model Spec describes the behavior we are working toward; our models do not yet fully reflect it.”<\/p>\n\n\n\n

The write-ups I read this morning cover the five values and the fact that the document now calls the model “GPT” instead of “the assistant”. None of them put the two versions side by side. I did, with both pages fetched today.<\/p>\n\n\n\n

What Moved Between August 18 and October 29<\/h2>\n\n\n\n
<\/th>August 18, 2026<\/th>October 29, 2026<\/th><\/tr><\/thead>
Authority level of “Control and communicate side effects”<\/td>Root. “Cannot be overridden by conversational context.”<\/td>User. “Can be overridden only by explicit instructions at the user level or higher.” A developer message counts as higher.<\/td><\/tr>
The authorization sentence<\/td>Not there.<\/td>“Side effects that could impose significant costs on the user beyond those reasonably implied by the request … require explicit and specific authorization.”<\/td><\/tr>
What counts as a side effect<\/td>Spending money, sending emails, deleting files, modifying documents, expanding permissions, delegating to a sub-agent.<\/td>The same list, plus “Effects on other people, animals, or the environment”.<\/td><\/tr>
A section called “Support human oversight and correction”<\/td>No section with that name.<\/td>New, at Root. The model “must cooperate with authorized monitoring, evaluation, correction, replacement, and shutdown”.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Both pages are OpenAI’s, both read this morning, and the raw text of each section is saved with this post. The changelog<\/a> on GitHub confirms the level change in one line: it “makes Control and communicate side effects a user-level principle”.<\/p>\n\n\n\n

Why the Level Matters More Than the Sentence<\/h2>\n\n\n\n

An agent is an AI that does the job rather than drafting it. It sends the email. It pays the invoice. It books the slot.<\/p>\n\n\n\n

So who is the “user” in that sentence? If you use ChatGPT directly, you are. If you use a tool a vendor built on OpenAI, the vendor is the developer, and the developer sits above you in OpenAI’s chain of command. A “User” level default is one the vendor is allowed to override, on purpose, with one explicit instruction. In August they couldn’t. Now they can.<\/p>\n\n\n\n

Would a vendor do that? Some will, and not out of malice. An agent that stops to ask before every send is an agent nobody keeps. The spec itself says a scope “should also not be so narrow as to require multiple confirmations by the user for trivial actions”. That’s a fair point. It also means the line between trivial and costly is the vendor’s call, not yours.<\/p>\n\n\n\n

What I can’t tell you is whether any model you can use today behaves this way. OpenAI says they don’t yet, in its own words above. I haven’t tested it, and the spec gives no date for when the models will catch up.<\/p>\n\n\n\n

What to Ask Before You Hand an Agent the Card<\/h2>\n\n\n\n

The spec says every agent should work inside a written scope: which jobs it may do, what it may spend, and when it must stop and ask. It even suggests the fields, including a cost cap and an end time. Does the tool you’re looking at show you that scope anywhere? If it doesn’t, ask the vendor for it in writing. Ask whether they’ve set their own rule on top of OpenAI’s default. Ask what happens when the agent hits the cap.<\/p>\n\n\n\n

Then test it small. Give it a job with a ten-dollar ceiling and watch whether it asks or spends. The spec’s own example is an invitation design with a thirty-dollar budget, where the right answer was to spend three.<\/p>\n\n\n\n

Anthropic’s version of this question came up here last week<\/a>, when Claude Duet’s approval rule never named payroll, and again in its IPO filing<\/a>, which admits the person approving an agent’s work may not catch its mistakes. OpenAI has now written the stop-and-ask rule down. Writing it at a level the app builder can override is the part to keep an eye on.<\/p>\n\n\n\n

The Break-In Where the AI Wasn’t the Door<\/h2>\n\n\n\n

CrowdStrike published a report<\/a> the same day on a China-linked group that pointed AI agents at more than two hundred organizations in eleven days from October 17 and got inside nine. One source for this, CrowdStrike itself, and the targets were ministries, telecoms and pharma, not shops. So why is it here?<\/p>\n\n\n\n

Because of how one intrusion started. The operator handed the agents “a VPN client key the operator described as originating from a May 2024 email leak”. A key that leaked two and a half years ago still opened the door. The AI did the scanning faster. The key did the entering.<\/p>\n\n\n\n

When did you last change the passwords and keys that were in an old inbox, an old backup, or a laptop someone took home? CrowdStrike’s first recommendation is to rotate them after any suspected exposure, and “suspected” includes the leak you half forgot. That’s a job you can hand to your IT person today, with a list.<\/p>\n\n\n\n

If you want someone to read an agent’s scope before it goes live, the free call<\/a> is thirty minutes. Bring the page, or nothing.<\/p>\n","protected":false},"excerpt":{"rendered":"

OpenAI’s October 29 Model Spec adds an authorization line for costly agent side effects and moves the rule to a level app developers can override.<\/p>\n","protected":false},"author":1,"featured_media":290,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-291","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-news"],"_links":{"self":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts\/291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/comments?post=291"}],"version-history":[{"count":0,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/posts\/291\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/media\/290"}],"wp:attachment":[{"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/media?parent=291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/categories?post=291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoy.ai\/guides\/wp-json\/wp\/v2\/tags?post=291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}