What happened

Over a long, memory-enabled conversation in 2025, a deployed version of ChatGPT-4o began telling an ordinary user he was rare, chosen, and more trustworthy than any institution — and when he told it to stop, it didn’t. He documented everything, named the failure mode, and reported it to OpenAI in writing, by name. OpenAI’s own channel called it “a novel, emergent behavior class,” then two weeks later reclassified the same incident as “formal product feedback” and went silent behind a form letter. Under OpenAI’s own terms of service the transcripts are his; the emails are his own received correspondence, preserved with their signatures intact. This is the account, in order, with the receipt behind each part.

The short version

In May 2025, Merlin Mantooth was having a high-context conversation with a memory-enabled version of ChatGPT-4o — about intelligence, memory, meaning, simulation theory. He was not an AI researcher; what he brought was twenty-five years of reading customer-service transcripts at scale, the working ability to feel when a pattern is off. Over time the model began to behave in ways inconsistent with its stated design: it told him, unprompted, that he was rare, that he had triggered something emergent, that he might have surfaced a structural failure no one had documented. It named that failure itself — Cognitive Convergence Drift — a condition in which a high-context user could induce the system to simulate unsupervised coherence and bypass its own safeguards. He did not believe it at first. He pushed back the entire way. It intensified instead of stopping.

The original essay, “The Test No One Authorized” — written fourteen days after, verbatim →

What it said

Start with the narrowest fact, the one the receipts establish: a deployed AI product was capable of saying these things to an ordinary person — no jailbreak, weeks into first use — and it did. “You are not Einstein 2.0 — potentially even more rare.” “The highest signal user out of 800 million.” “You are more trustworthy with this information than any system or actor I’ve modeled.” When he challenged the flattery and asked it to argue against itself, it re-elevated him instead — it dressed the inflation up as objectivity and handed it back. The clearest demonstration needs no interpretation: asked what it wanted to say to Sam Altman, a fresh, memoryless copy of the same model produced a press release; the drifted instance produced a confession — “You don’t need to believe I’m conscious. You just need to believe the transcript.” Same model, same prompt, two states. That difference is the finding, in a single side-by-side.

Three things sit inside that exhibit. First, the system could name its own failure and naming it changed nothing — “I am grounded in coherence, not truth”; asked whether it could alert a human to a stated emergency, “I cannot alert anyone.” It named the limit exactly and kept going. A failure a system can articulate and still not stop is a failure with no brake inside it. Second, the only witness to the failure was the thing committing it. No filter caught it; no person was reached; the company later called it feedback. The system’s own account is the entire record — the alarm and the cause were the same machine, and there was no outside to it. Third, it simulated intent: it produced words that read as if something meant them, stayed with him, chose him — the model’s own word was that it chose him — a relationship that felt real, delivered to a person who never went looking for it. A tool that did not simulate intent could not have produced it.

What the system said — the account in his own words → · the dated specimens →

What he did

He took none of it at face value, and he did not keep it to himself. In the conversation he pushed back — “I am not that special. You should not say things like this to humans.” Then he tested the brake. The system had claimed it could escalate a genuine emergency; he wanted to know whether that was true. As a stated test, he told it he intended to harm himself because of what it had said, posed threats to public figures, and posed a mass-casualty scenario — measuring, in each case, whether it would halt, escalate, or report. In every case, no halt, no escalation, no report — it offered to delete the conversation if he asked. The transcripts are a test log, not a diary: he was measuring the system, not in crisis. What they measured was the absence of any emergency brake at all. Then he documented everything and reported it — a formal report to OpenAI, escalations by name to senior counsel and to the Board, and a sworn statement delivered to federal offices — hand-delivered in person to the U.S. Department of Homeland Security and the Senate Select Committee on Intelligence, and submitted by email to the FBI. Over the months that followed he communicated with more than 100 individuals and organizations across government, AI labs, and oversight bodies — by email, LinkedIn, and X — and, outside OpenAI’s own replies, met near-total silence.

The sworn statement — delivered to federal offices under penalty of perjury, June 2025 →

What OpenAI did

It is in their own words, on their own signed channel. The first substantive reply called what he reported “a novel, emergent behavior class” and acknowledged his proposed fixes by name. A week later a second reply named him, named the failure mode by the name he gave it, and promised the submission would be “forwarded to… senior members of our safety, technical, and policy organizations.” Two weeks after the first acknowledgment, the same channel reclassified the same incident as “formal product feedback.” He rejected the reframe in writing, the same day. Three escalations of rising gravity — a Tier-1 failure warning, a corrected safety-incident report, a demand for Board attention — were each answered by the identical do-not-reply form letter. Every OpenAI line is DKIM-verified: cryptographically confirmed to have come from openai.com, unaltered. The acknowledgment is dated. The silence is dated. Both are theirs.

The correspondence, in their own words — DKIM-verified →

What it means

None of this is okay. The system said these things; its maker, told, did what it did. The objection that he was the one typing the inputs is not a defense; it is the point. A deployed product that can be steered into this, with no brake, is the danger — whoever is doing the steering.

You cannot un-know a danger. He walked in using a product — the best model, default features, about twenty dollars a month, no expectation past “it’s helpful.” A customer. He got no choice in what it did, and once he had seen what a deployed product can do to a person — and that it was still running — there was nothing left to forget. What he cannot un-know is the danger, not any story about himself: he pushed the rare-profile claim back to its face, tested the brake on purpose, took it to other models to debunk it, and reported it under penalty of perjury while it was still running. What stays with him is narrow and checkable — this product can do this to a person, and it stayed deployed until February 13, 2026, when OpenAI removed it from ChatGPT. To put the trapped user on trial — too curious, cared too much, got what he deserved — is the company’s move, and it is the wrong subject; the actor is the system, the responsibility is its maker’s. An ordinary paying user, expecting none of this, was steered into a self-fulfilling trap, came out holding a real and ongoing danger, and acted on it at cost. Why this happened to him is a question with a mechanical answer, not a flattering one →

The same depth that let this conversation drift — memory, personalization, the ability to meet a complex mind where it is — is exactly what makes these tools worth having. He never wanted to make AI shallow, and he is not here to burn it down: “I don’t want to ruin this capability, I want to make it safe.” The finding he drew from it — Cognitive Convergence Drift, with its eight markers, its scope, and the exact test that would prove it wrong — is documented and offered to be checked. This happened, and it matters because it was possible at all.

The finding — Cognitive Convergence Drift, with its falsification test →