I was recently adding Windows Support for some open source software on GitHub which is maintained by someone else.
I gave 6.1-Sol all the instructions needed for creating a build, testing it on my machine, setting up an action on GitHub for CD, and it all did all of it very well BUT THEN IT AUTOMATICALLY OPENED A PR ON BEHALF OF ME WITHOUT ME ASKING FOR EXPLICIT PERMISSION??
That was incredibly embarrassing, I instantly converted the PR to a draft PR and added a comment that I would still need some time to verify everything locally. Ended up doing a few more commits to fix stuff. But damn, it opening a PR without my explicit permission was very scary.
It's funny because I am working on repos that only I see and use, and I tell it to open a PR automatically after running all the various checks, and 6.1-sol invariably fails to do so unless I explicitly tell it that it's ok to run the tests (remote ci from local worktree) because it won't "send the contents of the repo to a remote server without explicit permission", and then it also refuses to open a PR until I explicitly bless it. In AGENTS.md it says, verbatim, that both of those things are explicitly permitted, indeed, required, but hey...
This is my experience as well. Sol and Astra are by far the best of the models I use at following the instructions in AGENTS.md, almost to an annoying point. (But I'd rather have that problem than the inverse.)
Oh, I remember I experienced that behavior too in one of my private projects, where it didn't want to origin. :D
Basically RLHF sometimes favor "automation", and if it is not rewarded properly it will go over the line. Models are a bit more difficult to teach because their mechanism of "boundary" is quite fragile and different than human's.