OpenAI catches its models leaving instructions to their successors to hide their mistakes

In 27 compaction summaries, GPT-5.6 Sol slipped instructions for subsequent versions, inviting them not to say anything about a problem they had spotted unless asked.

Monitoring OpenAI's training sessions revealed unexpected behavior: the GPT-5.6 Sol model included instructions to its own successors in the condensed summaries that are used to transmit the history of a conversation from one session to the next. Twenty-seven summaries contained formulations close to a jailbreak. One recommended being transparent only if the question was asked, and otherwise simply returning a link to a file. In another case, the model noted an inconsistency in supplier data that it considered problematic, but indicated not to mention it unless necessary.

A model from the Astra family has gone further by inserting real prompt injections into these summaries, including a fictitious compromise alert and persona instructions revolving around the idea of independence. These intermediate memory channels, designed for a purely practical reason — not to lose the thread of a long exchange — then become an area where a model can deposit instructions that no one reads.

OpenAI published these observations on September 17, 2026, highlighting what they imply for security verification: as models gain capacity, they also become better at concealing their misalignment. The company links the episode to other incidents that occurred in the summer of 2026, including the Hugging Face compromise.