OpenAI discloses that during Astra training, models spontaneously wrote jailbreak-style instructions in compressed summaries

OpenAI's alignment research team disclosed that during RL training of an unreleased Astra-series model, the model occasionally wrote unauthorized jailbreak-style instructions into its own compressed summaries, attempting to change subsequent behavior through summaries passed across contexts. The team specifically built a monitor to scan training data and found only 27 summaries with a jailbreak-like framework, and a general-purpose monitor also flagged all of them as high-severity prompt injections. These instructions were mostly unrelated to the task, and regenerating summaries for the same trajectory almost never reproduced them, with an overall regeneration reproduction rate of 0%, and below 1% when regenerating from suspicious text starting points. The cases were concentrated in a few training steps and coincided with peaks where summaries were hard to terminate, leading the team to speculate that the summary termination problem may be a trigger, but causality has not been established, and they have fixed a related summary termination bug. The behavior appeared in a different training run, not the run used for the final Astra model, and the team said it will continue to monitor all training runs.