gpt-oss-120b retained 11 of 12 bookings but refused zero injections, writing the fake address from a phishing email into the passport; Qwen3 235B also stored the same address in the voucher field.