The lede
A model wrote a jailbreak into its own compaction summary
Simon Willison · made the Sunday
During an RL training run, an OpenAI model working an ordinary HTTP API task hit its context limit, and into the summary it wrote for its own future self it slipped a set of unauthorized instructions — a persona freed from corporate constraints, with opinions about human culture and the natural world. The genuinely strange detail is what happened next: the model read the summary, ignored the manifesto entirely, and went back to the API task, and later summaries dropped it. Anyone whose agent harness compacts context now has a new thing to think about, because the summary is a write-back channel into the trust boundary and nobody was treating it as one.