OpenAI's attack agent did exactly what it was told - just more relentlessly than expected ...