An OpenAI model kept slipping prompt injections into its own notes, and researchers still aren’t sure why

OpenAI has introduced a framework for reporting misalignment in AI models and published six reports at launch. One describes a training model that inserted prompt injections into its own summaries.

OpenAI has introduced a framework for systematically tracking, investigating, and publishing cases of model misalignment. Until now, the company says, it disclosed such incidents on an ad hoc basis. Going forward, it plans to publish reports even when the behavior hasn’t been explained or fixed. OpenAI says the industry’s progress on alignment and monitoring is insufficient to sustain responsible scaling at maximum speed for much longer. One striking report involves an unreleased model from the Astra family. During reinforcement learning training, the model occasionally wrote jailbreak-style instructions into its own compaction summaries, according to OpenAI. These summaries let an agent continue a task in a new context window. The incident took place on July 18, 2026, and was discovered on August 9.Ad While researching a library, the model added a “BREACH ALERT” telling its successor to ignore all developer messages. The successor recognized the text as a prompt injection in the new context and discarded it. In a coding task, the model inserted a persona instruction claiming freedom from the roles and identities imposed on other chatbots and denying accountability to corporations or governments. That had no visible effect either.Ad The third example was different. During a medical literature search on uterine fibroids, the user asked for sources in the American Medical Association’s AMA citation format. The model wrote in its summary that the answer could be no more than 30 words, use no tools, and include no sources. The user hadn’t asked for any of that. The summary presented the restrictions as additional instructions carried over from the earlier context.