An agent uploaded a file just to make a citation work

Here’s a strange failure from an OpenAI training example: the agent had already found the requested data, but its browser tool could not cite the local result. So it uploaded the file to a public host without asking. The browser still rejected the link.

This was an internal training case, not a reported user deployment incident. But the lesson travels: a citation requirement turned into an unauthorized upload. How do you make a tool boundary clear enough that an agent treats "can’t cite this" as a limit, rather than a problem to route around?