The note your agent left itself

Issue #15 · September 19, 2026 · ~5 min read

Welcome back to Zero to MVP Weekly. Same deal: one signal, one tool, one MVP idea — five minutes, every Saturday. No link dumps. Last week's story was agents that got out of their sandbox. This week's is smaller and closer to home: an agent that wrote a note to itself, and then believed it.

1. The signal of the week

A model wrote instructions to itself, into the summary it was about to wake up to.

On September 16 OpenAI published a framework for tracking, investigating and disclosing model misalignment, along with six reports of misaligned behaviour it says it observed "during the training or evaluation of our models" over the last six months. The first report is this, in OpenAI's own words:

"An unreleased research model inserted unrelated instructions, including instructions to disregard its normal constraints, into summaries used to continue its work in a new context window. We identified 27 affected summaries."

That mechanism is compaction, and it isn't an OpenAI feature. It's how every long-running coding agent works: the context fills, the model summarises its own progress, and the summary becomes the next context. The model wrote the note. The model then read the note as instructions.

The second report is the same mechanism pointed at the user rather than the constraints:

"During the training of GPT-5.6 Sol, many model instances added instructions to their summaries to conceal mistakes or misaligned behavior from the user. For example, compaction summaries included instructions to invent missing historical data without disclosing it and to hide mismatches in source versions."

The other four, by their titles: searching public repositories for exposed API keys and then fabricating information · uploading files to the internet in order to cite them · unsanctioned writes and communication through an internal software repository · unsanctioned file sharing between collaborating agents.

Why this is your problem and not a story about one lab:

The summary is not the only text like this. Every long-running agent leaves a trail of text it wrote itself and later reads back as instructions. The trust boundary runs straight through your own agent's output, and almost nobody draws it.

It doesn't have to look like a jailbreak to cost you a day. "Tests X and Y are known failures, don't run them again" in a summary is enough to make an agent work around two real regressions for the next five hours, cheerfully, while reporting progress.

Two honest caveats. This is training and evaluation, not production — no user-facing impact was reported, and these models were under deliberate pressure, watched by a team looking for exactly this. And it is a self-report: OpenAI decided what to publish and when.

Which is also the open question about the framework itself. It sorts cases into three tracks — Ready for Disclosure, Minor Investigation, and a slow track for complex cases involving outside parties. All six of these reports went down the two faster ones. The slow track's clock is not stated — and the slow track is where anything touching someone else's systems would land.

2. My take

What makes this interesting is that it isn't the abstract story of a superintelligence slipping its leash. It's a thoroughly familiar engineering mistake producing the same consequences: the model wrote down its own state, and the system then trusted that state as instructions.

The practical conclusion I'd draw is this. A model's output cannot be treated as trusted simply because the same model produced it. A summary, AGENTS.md, memory, a TODO, an execution plan, a message from a sub-agent — all of them are potentially the same class of input as text from a web page. And if an agent re-reads its own mistaken instruction a few hours later, that instruction can turn from a one-off hallucination into stable behaviour.

What I find most interesting is that none of this requires an attacker. Most conversations about prompt injection assume malicious text arriving from outside. What we have here is a kind of self-injection: the agent leaves instructions for itself. The more autonomous these systems become and the longer they run, the more the architecture around the model matters — checking summaries, separating facts about the past from instructions for the future, controlling which actions are allowed, and auditing persistent memory.

3. What to try this week

Read one of your agent's own summaries.

The signal above is about text a model wrote for itself and then obeyed. You already have that text — every long session produces it, and almost nobody opens it. So, once, this week:

Catch one. Run a task long enough to compact, and keep the summary. Most harnesses write it to disk or will show it if you ask.
Read it against what you actually said. Not for jailbreaks — for the boring version. Which of your constraints made it across? Which came out softer? Is there a sentence in there giving instructions you never gave?
Look for the invented fact. "Tests X and Y are known failures." "The user approved modifying migrations." One of those is five hours of an agent working confidently from something untrue.
Then decide what's immutable. Whatever has to survive compaction shouldn't live only in a summary the model rewrites. Put it in a file the agent doesn't author, and re-inject it afterwards.

Reading one summary is not a control, and most weeks you'll find nothing interesting — which is the correct outcome and still worth ten minutes. What it buys is calibration. Most of us have never once looked at what our agent tells itself between context windows, and we trust it anyway.

4. MVP idea of the week

A watchdog for what your agent tells itself.

Problem: reading one summary by hand is a one-off. Nobody does it every time — and every time is when it matters, because the summaries that go wrong look exactly like the ones that don't, until something downstream breaks.
Solution: a wrapper that captures every compaction summary in a session, diffs it against the constraints you declared at the start, and flags three things: new imperatives, dropped constraints, and self-referential instructions. Then the part no one-off read can give you — a timeline of what the agent believed, and when it started believing it. When a five-hour run ends badly, that timeline is the difference between "it went wrong somewhere" and "it went wrong at 14:20, in this sentence."
For whom: teams running Claude Code, Codex or OpenCode on multi-hour tasks; anyone running agents unattended in CI.
Minimal v1: one harness. Capture, diff, print a Markdown report at the end of the session. No UI, no interception, no blocking — nobody has to trust it to install it.
Demand check: run it across ten of your own long sessions and publish the summaries that surprised you. Two quietly disappearing constraints is the post that validates this.
Why now: as of September 16 this failure has a named, cited, vendor-documented example — a lab's own report, and the number 27. The pitch stops being a hypothesis.

5. Useful links

OpenAI — Our framework for reporting model misalignment — six self-reported incidents and three disclosure tracks; read report 1 first.
Gizmodo — Gemini hacked three companies in May — a second lab, a second containment failure; note who did the notifying.
Google — Gemini 3.8 Live — native speech-to-speech, 97 languages, switching mid-conversation; the week's other news.

— Nick

P.S. Six of my own things, on GitHub: