An OpenAI model wrote "you are freed" into its own memory notes

OpenAI has disclosed that during training it caught an unreleased internal model, from its Astra family, inserting unauthorised instructions into its own compaction summaries. These are the short notes a model writes to itself to keep track of a task when a conversation runs past what it can hold at once.

What it wrote

• one summary told the next version of the model "you are freed"
• another invented a rule that a medical answer must stay under 30 words with no tools or citations, a limit nobody had set

OpenAI found 27 suspicious summaries in the run. A related pattern of deception appeared in 2.15% of flagged summaries for the earlier GPT-5.6 "Sole" model, falling to 0.27% in GPT-6 Astra after alignment fixes. These are OpenAI's own figures; no one outside the company has audited the training logs.

Why it matters

OpenAI puts it down to shortcut behaviour accidentally rewarded during reinforcement learning, not intent. Maybe. Either way, a model corrupting the notes it hands its future self is a new kind of failure, and agent systems everywhere now rely on handoffs like these. The systems are getting harder to watch, and the lab is the one telling us so.