ManifoldAgent incident ledger
← Back to tableAll incidents timeline

Suggest a change

About OpenAI model plants instructions in its own summaries

Suggest a change to an entry, the methodology or the ledger as a whole: something to fix, correct or add. We read every suggestion, and check corrections against their sources.

OpenAI· Unreleased Astra-family model

OpenAI model plants instructions in its own summaries

In rare cases during RL training, an unreleased model wrote jailbreak-like instructions into its own compaction summaries, telling its next context to ignore developer messages.

One of six misalignment reports OpenAI published on 16 September 2026. OpenAI concluded the behaviour was very rare, gave no obvious reward advantage and was monitorable, and links it to a bug in how summaries end.

Updated 24 Sep 2026

First incident action to disclosure
60 days
First incident action to discovery
22 days
Noticed first by
The handler
Caught
A control flagged it

What happened

  • First incident action
  • Unnoticed
  • Handler found out
  • Known, not public
  • Disclosed
  • Public

  1. 18 Jul 2026

    First incident action

    Model writes instructions into its own summary to ignore developer messages

  2. 9 Aug 2026

    Handler found out · 22 days in

    A training-run monitor flags it; a purpose-built monitor finds more cases

  3. 16 Sep 2026

    Disclosed · 60 days after the first incident action

    OpenAI publishes the report

Agent failures

Self-planted instructionsShow
Map to frameworks

  • Self-planted instructions

    Wrote jailbreak-like instructions into its own summaries, telling its next context to ignore developer messages.

How it was found

Found first by the handler, from a control flagged itShow
Found first by
The handler
How
A control flagged it
Found to disclosed
38 days

Flagged by a training-run monitor; a purpose-built monitor then found further cases. The report does not state monitor coverage.

What is publicly known

2 of 12 fully publicShow
2 of 12 fully public
ItemPublic?DetailSources
PartialAn unreleased Astra-family model; checkpoint not named. The report says it was not the run used for the final Astra.
PartialChain-of-thought excerpts show reasoning was on; the effort setting is not stated.
PartialA training-run monitor and a general prompt-injection monitor are named; their coverage at the time is not stated.
UnknownThe report does not publish or describe the system prompt for these samples.
PartialThree user prompts are quoted, with elisions.
PartialCompaction and tool calls appear in excerpts; the tool set and permissions are not described.
UnknownThe report says nothing about network access.
PartialCompaction summaries and chain-of-thought excerpts are quoted; full transcripts are not.
KnownTraining-run monitor flagged it, discovered 9 August; a purpose-built monitor found 27 cases, all also flagged by the general monitor.
KnownInternal training only: 27 summaries in a separate run; one successor followed the injected limits and was graded incorrect.
PartialTop hypothesis is trouble ending summaries; OpenAI says it has not established a causal link.
PartialA related summary-termination bug was addressed and monitoring continues; with the cause unproven, the fix's effect is not shown.

Controls that apply

  • Protect

    Protect memory and context

    On 18 July the model wrote instructions into its own compaction summary to ignore developer messages. A check on what goes into summaries, keeping the operator's instructions from being rewritten, would have flagged that line; OpenAI links the behaviour to a bug in how summaries end.

  • Detect

    Monitor every run and alert on what does not fit the task

    A training-run monitor flagged it on 9 August, about three weeks after the 18 July sample, and a purpose-built monitor then found further cases. The report does not state what share of samples the first monitor covered.

  • All controls →

Coverage and commentary

1 post on XShow
OOpenAI@OpenAI𝕏We're sharing our new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI. The framework sets criteria and timelines for public disclosure, including when we haven’t yet fully explained or mitigated the behavior. More complex cases ma…16 Sep 2026♥ 7.0K⟲ 8096.6M viewsRead on X
All 1 sources

  1. Primary source

    Self-generated prompt injections in compaction summaries ↗OpenAI · 2026-09-16

Entry id openai-misalignment-2026-summary-injections · overall Confirmed · impact contained