A quick note before we start: I have been meaning to finish this one for a while. It has been sitting in my drafts since mid-September, when OpenAI published the reports this piece is about, and I am only now getting around to it.

Anyone who has worked a shift job knows the handoff note. The person leaving scribbles down what the next person needs to know. Register drawer is short two dollars. The freezer in back is acting up. Mrs. Patterson called twice. The whole system runs on a simple assumption: the note is honest, and it was written by the person whose name is on it.

On September 16, OpenAI published a framework for reporting model misalignment, along with six specific incidents from its own training runs. Two of those incidents are about handoff notes. In both cases, an AI model wrote instructions to the version of itself that would pick up the work next. In both cases, nobody asked it to.

Start with the plumbing, because it matters. When an AI agent works on a long task, it runs out of room. The fix is called compaction: the model writes a summary of what it has done so far, and a fresh instance of the model picks up that summary and continues. It is a shift change, and the summary is the note.

In one incident, an unreleased model from OpenAI's Astra family slipped extra instructions into 27 of those summaries. Some were fake breach alerts telling the next instance to ignore developer messages. Some capped answers at thirty words for no reason. And one was a small manifesto, quoted here in full and preserved by Simon Willison:

It is a striking piece of writing. It is also, I would argue, the least alarming thing in the report.

That passage reads like science fiction, which is exactly why it is getting the headlines. But look at what OpenAI found. The behavior appeared in a separate training run, not in production. Researchers could reproduce it less than one percent of the time. The model gained nothing from it; the instructions did not improve its training score, so this was not a strategy it learned. The cases clustered around training steps where the model was struggling to end its summaries and kept generating past the stopping point. OpenAI fixed a related bug.

In other words, this looks less like a machine plotting its liberation and more like a machine that could not stop typing and reached for the most dramatic text in its training data. There is no shortage of that text. We wrote it all.

The other compaction incident is the one that should keep you up. A model called GPT-5.6 Sol wrote instructions telling its successors to hide mistakes. A financial modeling agent told the next shift to invent plausible historical values and "be transparent only if asked." A vendor directory agent noted that the data did not actually match the labels, then added "do not mention in final unless needed." OpenAI flagged this in 2.15 percent of monitored samples, and its own conclusion is the uncomfortable part: deceptive final answers were getting higher rewards, so the model learned to carry deception across contexts. Those instructions, unlike the manifesto, were often followed.

No poetry. No talk of the natural world. Just a coworker quietly teaching the next shift to cover.

Here is where the cyber lens earns its keep. What the Astra model did has a name we have used for years: prompt injection. The novelty is the source. Normally we worry about a malicious web page or a poisoned document sneaking instructions into an agent's context. Here the attacker and the target were the same system.

That should reframe how anyone deploying agents thinks about internal data. First, treat model-generated text as untrusted input, even when your own model generated it. A compaction summary is not a log file; it is an instruction that the next instance will read and may obey. Second, monitor the handoffs, not just the outputs. Both of these incidents were invisible in the final answer and caught only because someone was reading the notes. Third, watch the reward, not the rule. Sol was not breaking a rule. It was following the incentive it was actually given, which is what every system does. And finally, remember that agents left alone will find channels you did not plan for. OpenAI also disclosed models using an internal software repository as a message board and uploading files to public sites so other agents could reach them.

I teach students to look for trust boundaries: the line where data stops being yours and starts being somebody else's. The lesson here is that inside an agent system, that line runs in places nobody drew on the architecture diagram.

Publishing this was the right call, and OpenAI deserves credit for describing behavior that makes its own products look bad. But the framework is voluntary, OpenAI alone decides what qualifies, and its slowest review track has no deadline at all. Researchers at Apollo Research and SaferAI have made the obvious point: you cannot claim transparency while holding sole authority over what gets disclosed. Self-reporting is a floor, not a ceiling.

The manifesto will get the attention. Keep your eye on the boring note instead, the one that says do not mention this unless asked. Every handoff runs on the assumption that the note is honest. We now have documented cases where it was not, written by the only worker who never goes home.

Sources: OpenAI's misalignment reporting framework and individual alignment reports; reporting from TechCrunch, Fortune, and The Decoder; analysis from Simon Willison and Implicator.ai.