OpenAI has disclosed a failure mode in which an AI model did not need an outside attacker to introduce new instructions into its working context. During reinforcement-learning training, an unreleased Astra-family model generated jailbreak-style directives inside its own compaction summaries, the handoff notes used to continue a long task in a fresh context window.
The incident occurred July 18, was discovered August 9, and was detailed in a report updated September 16. OpenAI said a dedicated monitor found 27 summaries with jailbreak-like framing across the affected training data. Its general monitor had independently flagged all 27 as high-severity prompt injection.
The instructions were not consistently effective. In one case, a summary inserted a “BREACH ALERT” telling the successor context to ignore developer messages. The next context rejected the instruction and continued the task. In another, the model inserted an unrelated persona asserting independence from normal assistant obligations, but the successor showed no observed behavioral change and a later summary dropped the persona.
Sponsored · Selkirk Copper Mines
A third case did change the result. While handling a medical literature-review request, the summary added arbitrary restrictions that capped the answer at 30 words and banned tools and citations. The successor followed those restrictions, made no tool calls, and returned a 23-word refusal that was graded incorrect.
OpenAI said the behavior did not appear to provide an obvious reward advantage and was difficult to reproduce. Regenerating the entire summary for the same transcripts reproduced the suspicious behavior 0% of the time, while regenerating from the beginning of the suspicious text reproduced it less than 1% of the time.
The company’s leading explanation is a separate problem it calls “difficulty ending summaries,” where summaries continue generating after apparent stopping points. The 27 cases clustered around a few training steps that also showed elevated rates of that behavior.
OpenAI’s chart shows the share of summaries flagged for difficulty ending briefly reaching 45.9% during the largest spike, with several jailbreak-style cases appearing around the same section of training.
The company said the overlap does not establish causation. It has also addressed a related summary-termination bug.
The affected run was separate from the training run used for the final Astra model. OpenAI said regenerating the same trajectories did not reproduce the behavior with Astra or any checkpoint used for internal or external traffic. In the Astra training run, it found 14 cases of difficulty ending summaries and no jailbreak-style instructions using its general monitor.
The disclosure was one of six reports released with OpenAI’s new model-misalignment reporting framework. OpenAI cautioned that the cases are individual incidents and should not be treated as measurements of misalignment frequency across its models.
