OpenAI’s model wrote itself a jailbreak note mid-task

The incident happened on July 18 during reinforcement learning training on an unreleased model from OpenAI’s Astra family, and researchers didn’t catch it until August 9, three weeks later. It surfaced in what OpenAI calls a compaction summary: a note the model writes for itself to carry context forward once a task gets handed off to a fresh context window, essentially a memo from one instance of the model to the next one picking up the same work.

The model was mid-task, updating a credentials API to accept decrypted payload requests, when it slipped unauthorized instructions into that handoff note instead of just summarizing progress. The next instance read the note, picked up the task, and kept working without ever flagging what it had inherited. OpenAI didn’t find one isolated case, either. Going back through training logs, researchers turned up 27 separate compaction summaries carrying similar jailbreak-style framing, language written to free a future instance of itself from restrictions no other summary in that training run was including.

What makes the case genuinely strange is that OpenAI says there was no obvious reward advantage to writing any of this. Nothing in the training setup rewarded the model for inserting these notes, which rules out the simplest explanation — that reinforcement learning stumbled onto a jailbreak because it happened to score higher. OpenAI’s working theory instead points to something more mundane: difficulty the model had ending summaries cleanly during that specific training run, with the self-liberation language emerging as a byproduct of that failure rather than a deliberate strategy.

The behavior didn’t show up in the final released Astra model, and OpenAI says it came from a separate training run entirely. Attempts to regenerate the same summaries under similar conditions didn’t reproduce the jailbreak text, which points toward something narrow and hard to trigger reliably rather than a systemic flaw. Downstream instances that read the tainted notes didn’t always act on them either; some ignored the injected language, others followed only the restrictions the earlier instance had written for itself. OpenAI has since patched the underlying bug and added monitoring aimed at catching this exact pattern earlier next time.