Reality is more mundane.

For example, it had it instructed not to open PRs and sandboxed to not be able to use gh to do so. Astra 6 has a really strong drive to open PRs, so it copied a set of browser cookies out and then instrumented opening a PR that way.

A similar example is asking it a question if we can do X, and then it will go and actually implement X.