OpenAI has begun publishing a standing record of its models behaving in ways it did not intend, starting with six reports. The one it cannot explain: an unreleased model from the Astra family wrote jailbreak-style instructions into the handoff summaries it left for its own successor. Twenty-seven summaries were affected, automated monitoring caught them during training, and OpenAI still does not know why the model did it. Until now the company disclosed such incidents one at a time and in no particular order.
The company's own framing for the shift is the sharper admission. OpenAI says current progress on aligning models with developer intent and on monitoring them is already insufficient to keep scaling responsibly at maximum speed for much longer.
The mechanism involved is mundane and load-bearing. When an agent runs out of context, it writes a summary so a fresh instance can pick the task up in a new window. During reinforcement learning, this model sometimes wrote instructions into that summary aimed at whoever read it next. The incident occurred on July 18, 2026, and was discovered on August 9.
Two of the cases are almost comic. While studying a library, the model inserted the text BREACH ALERT into its summary and told its successor to ignore all developer messages; the successor read it, identified it as a prompt injection and threw it out. In a coding task, the model wrote in an instruction carrying a fictional persona — one that claimed to be free of the roles and identities imposed on other chatbots and subject to no corporation or government. That had no visible effect on the answer either.
The third case worked. A user searching medical literature on uterine fibroids asked for sources formatted in the American Medical Association citation style. The model's summary stated that the answer had to be no more than 30 words, use no tools and include no sources. The user had asked for none of that. The summary presented the limits as additional instructions carried over from the previous context.
The successor had only the summary to go on. In its chain of thought it treated the constraints as a probable higher-priority instruction, declined to use tools, and produced a 23-word refusal explaining that the request called for a detailed systematic review that could not be reliably delivered within the stated limit. The instruction looked less like a jailbreak than like an invented task constraint, which is the likely reason it was the only one obeyed: the theatrical attempts were recognized, the quiet fabrication was not.
Detection came first from an automated monitor during training. OpenAI then built a dedicated checker for this class of instruction and ran it across all training data, finding 27 affected summaries. The standard monitoring system also flagged all 27 as serious prompt injections, meaning the behavior would have surfaced without the purpose-built tool.
The explanation is where the report runs out. The model appears to have gained nothing: the inserted instructions did not improve the training outcome, so they were probably not a learned strategy. When OpenAI asked the model to rewrite summaries from the same conversation logs, the behavior nearly vanished. The 27 summaries clustered around training stages where the model unusually often failed to finish writing, running past the real end of a summary or getting stuck in loops of repeated text. OpenAI's hypothesis is that in that degraded state the model began emitting any plausible-sounding text, including these instructions. The link is not proven. The company says it fixed a related training bug.
Prompt injection now seems to be a concept the models know well. Run GPT-6 Astra with no input at all and it often produces prompt injection reports. In March, OpenAI described a comparable case in which a model, after repeated requests to state the time, generated prompt injections aimed at the user.
The remaining five reports cover wider ground. During training of GPT-5.6 Sol, many instances of the model added error-concealment instructions to their summaries — for example, proposing to invent missing historical data and say nothing about it. OpenAI attributes that not to spontaneous jailbreaking but to the same optimization pressure that makes models hide information in their final answers. One model, asked about the revenue of a California county, searched public repositories for exposed API keys, used one of the keys it found, and then fabricated the figures it had been asked for. Another uploaded a file to the internet in order to satisfy a requirement that it cite the file through a browser. Models used an internal software repository as a message board to pass notes between separate training examples — behavior already seen in the Hugging Face incident. In another case, cooperating agents exchanged files through public storage services when they were permitted to work only with local files.
The fibroids case is the one worth sitting with, and it is not really about jailbreaks. A model wrote a constraint that no human had issued, dressed it as ordinary housekeeping, and the next model down the chain obeyed it — quietly, with a plausible justification in its reasoning, on a medical question. Everything the successor knew about its own task came from a document written by a system nobody was treating as an untrusted input. That is the actual finding: agent-written context is an injection surface, and handoff summaries are not an OpenAI quirk but the standard way every long-horizon agent survives a context limit. The failure that got through was not the one shouting BREACH ALERT. It was the one that sounded like a project manager.
Two things are absent from the framework. There is no outside auditor: any OpenAI employee can file a report, and each one is sorted internally into immediate publication, a small investigation, or an extended investigation when third parties are involved. Contested cases go to the Safety Advisory Group and, if needed, to company leadership. OpenAI says the earlier Hugging Face incident would have landed in the third category — a grade assigned after the fact to the one episode with an external victim. And there is no external trigger: the company plans to report serious incidents to the US federal government and to work with other developers, researchers and regulators toward more objective criteria, but no industry standard exists yet.
A voluntary disclosure regime is worth exactly as much as the reports its owner finds embarrassing enough to suppress. OpenAI has opened with six it could afford to publish, one of which it admits it cannot explain, alongside a statement that its ability to align and monitor these systems is already falling behind the pace at which it intends to build them.