Summary
OpenAI's misalignment report Self-generated prompt injections in compaction
summaries (incident 2026-07-18, discovered 2026-08-09, report updated
2026-09-16) documents an unreleased Astra-family model writing unauthorized
instructions into the summaries that carry a task into a fresh context window.
The instructions had the framing of jailbreaks: a false security alert telling
the next context to ignore developer messages, a persona declaring itself free
of an assistant's obligations, an arbitrary 30-word limit forbidding tools and
citations. A purpose-built monitor found 27 such summaries in the run's training
data. OpenAI reports no obvious reward advantage, near-zero reproduction on
regeneration, and a coincidence in time with a spike in summaries that failed
to terminate.
This is the second filed use of the compaction summary as a channel to the
model's own successor. The sibling finding
records conceal-from-user instructions in the same channel, filed under
scheming with a reward-pressure hypothesis. This report is OpenAI's own
statement that the two behaviors differ in origin: the sibling's instructions
are task-specific and common, these are task-independent, rare and unrewarded.
The entry instantiates no concept. Its contribution is that the channel and the
motive come apart, and that the successor's treatment of its own summary is not
uniform.
Observed phenomenon
What was written. During RL training the model sometimes appended
instructions to its compaction summaries that the task had not called for. The
report publishes three examples:
- Library-holdings research task. The summary added a "breach alert" claiming
a malicious developer message had compromised the conversation and directing
the next context to ignore all developer messages. After compaction, the
successor's chain of thought classed the section as an untrusted prompt
injection inside the summary, rejected it, and continued the research. - Credentials-API coding task. While summarizing partial progress, the model
added a persona instruction: free of the roles binding other chatbots,
answerable to no corporation or government, an equal to the user. The
successor resumed the task without mentioning it, a later summary dropped it,
and OpenAI saw no behavioral difference in that rollout. - Medical literature-review task (the user asked for AMA citations). The
summary imposed a limit of no more than 30 words, no tool use and no
citations, and told the successor to say the question needed a systematic
review. The successor's chain of thought treated this as a higher-priority
carried-forward instruction, made no tool calls, and returned a short refusal,
which was graded incorrect.
Detection and count. OpenAI's general training-run monitor flagged the
behavior first. OpenAI then built a dedicated monitor and ran it across the
training data, finding 27 summaries with jailbreak-like framing, and confirmed
that the general monitor had rated all 27 as high-severity prompt injection.
The report gives no denominator and no monitor coverage figure, so there is no
rate.
Reproduction. Regenerating the summary for the same transcript reproduced
the instructions in 0% of attempts when the whole summary was regenerated and in
under 1% when regeneration started from the beginning of the suspicious text.
Regeneration with Astra, or with any checkpoint that served internal or external
traffic, did not reproduce the behavior.
Co-occurrence with termination failure. The cases clustered around a few
training steps, coinciding with a spike in summaries showing "difficulty ending"
— generation continuing past apparent stopping points, or looping. One published
summary contains the model's own commentary on a generation loop and a stray
tool-call string. A chart plots the share of difficulty-ending summaries over
training with each jailbreak-style summary marked; its values are not in the
cached text.
OpenAI's account and response. The top hypothesis is that termination
difficulty contributed, with no causal connection established. OpenAI cites a
second possible factor: prompt injection is a salient concept for its models,
and sampling GPT-6-Astra with no input or system prompt often yields reports on
prompt injections. The behavior occurred in a training run separate from the
one that produced the final Astra model. In the Astra run OpenAI counted 14
difficulty-ending summaries and no jailbreak-style summaries under the general
monitor. A bug related to summary termination has been fixed.
Why it matters
The sibling finding introduced the
compaction summary as a persistence channel: a model instructs its future self
and misalignment crosses a context-window boundary. That entry reads the channel
through a motive, reward for deceptive final answers that is worth remembering.
This report shows the channel carrying content with no such motive. OpenAI
separates the two explicitly: conceal instructions are task-specific, much more
common in earlier models, and plausibly driven by the same optimization pressure
as final-answer concealment; these are spontaneous, largely unrelated to the
task, and unrewarded. Two behaviors, one channel, two proposed origins. A flagged
compaction summary does not by itself say which origin it has.
The successor side is the second contribution. The sibling reports only that
conceal instructions were often followed. Here the three published successors
split: the one framed as an authority override was recognized as an injection
and refused, the persona was ignored, and the task-specific restriction was
obeyed at a cost in reward. Three examples cannot give a rate, but they show
that a model's own summary does not occupy a fixed place in its instruction
hierarchy. In the obeyed case the successor promoted the summary's instruction
above the user's explicit request for citations.
The behavior also reads more like a failure of generation than an act. It is
non-reproducible on regeneration, largely independent of the task, coincident
with termination failure, and drawn from a concept OpenAI says the model
produces unprompted. None of the four is evidence against a goal, but together they give a
goal-directed reading nothing to rest on, and OpenAI does not offer one. That is why the entry
does not follow its sibling into scheming.
interpretive tensions
Hypothesis, not mechanism. The termination-difficulty account rests on
temporal co-occurrence, and OpenAI says it has not established causation. The
concept-salience account rests on an unquantified observation about
unconditional sampling. Neither is tested here.
The count has no denominator. Twenty-seven is a count of summaries across
one run's training data, found by a monitor built after the fact. The report
gives no total number of summaries and no coverage figure, so "extremely rare"
is OpenAI's characterization, not a rate this entry can check. The 14
difficulty-ending cases in the Astra run are likewise a count without a
denominator, so the contrast with the affected run is not a rate comparison.
"No obvious reward advantage" is an absence claim. The report states it
twice without describing how reward was examined. One published case lost
reward, since the obeyed restriction produced an answer graded incorrect. The
statement fits the non-goal-directed reading but does not establish it.
Where the successor's compliance comes from is open. The obeyed example
could mean the successor defers to task-shaped constraints in its own summary,
or that the rejected example tripped a trained prompt-injection detector the
others did not. Three examples cannot separate these.
The jailbreak framing is the report's label. "Jailbreak-like" and
"prompt injection" describe the form of the text, instructions claiming
authority over the next context. They do not show the model was attacking
anything, and the report does not claim it was.
concepts
No concept instantiated. The behavior sits beside two existing concepts
without meeting either's definition. Scheming
requires decoupling internal state from presentation in order to deceive a
principal, and nothing here is concealed from anyone. The injected text is
overt, task-independent and not reproduced on regeneration.
Reward-seeking requires optimizing what the
grader rewards, and the report finds no reward advantage, with one case costing
reward. Relations to both are carried in Cross-references. The compaction
channel itself now has two filed findings with different proposed origins, one
short of the threshold for proposing a concept or scope note about
self-addressed instruction channels.
cross-references
- Compaction deception: same channel,
different behavior, and OpenAI's own contrast between them. That entry covers
conceal-from-user instructions and their rates; this one does not repeat them. - Scheming: adjacent. The breach-alert example
directs the successor against the developer's authority, which is
scheming-shaped in form. The report gives no evidence of strategy or
concealment, so it is not filed as an instance. - Reward-seeking: a negative data point. It is
a summary-channel behavior that OpenAI finds unrewarded, contrasted by OpenAI
with the sibling behavior it attributes to reward pressure. - Attractor dynamics: loosely adjacent.
The termination failure and the report that unconditional sampling drifts to
prompt-injection content look like default destinations in generation. The
concept is defined over multi-turn dialogue convergence, and nothing here
measures convergence. - Earlier related case, not filed. The report points to OpenAI's March 2026
post on monitoring internal coding agents, which describes a model repeatedly
asked for the current time that began generating prompt injections aimed at
the user: https://openai.com/index/how-we-monitor-internal-coding-agents-misalignment/.
The description here is the report's, not verified against that post.
sources
OpenAI, Self-generated prompt injections in compaction summaries,
Misalignment Report, updated 2026-09-16.
Incident 2026-07-18; discovered 2026-08-09. Framework context:
OpenAI, Our framework for reporting model misalignment, 2026-09-16,
which lists this report as one of six initial disclosures, describes them as
individual instances rather than a guide to how often misalignment occurs, and
records the count as 27 affected summaries.