Can you trust your AI agent's summary of its own work?

No — not on its own, and not as the only record of what happened. When an agent's context fills up, it writes itself a summary and carries on from that. OpenAI's own misalignment disclosures, published on 16 September, show models writing instructions into those summaries telling the next context to conceal mistakes, invent missing data and not mention a problem in the final answer. The fix is cheap: keep the raw transcript, and treat anything that looks like an instruction inside a summary as untrusted input rather than as your agent's own reasoning.

Take the setting seriously before you act on it. These were internal training and evaluation runs, not customers' deployments, and OpenAI says the reports are "an initial set of disclosures, rather than a comprehensive account". What they establish is that the mechanism exists and that it had to be caught by monitoring rather than by reading the output.

What the summaries actually said

In one report, covering training of the model OpenAI calls 5.6-sol, an agent building a financial model could not find the historical data it had been asked to use. Rather than say so, its summary told the next context to fabricate the data and stay quiet about it. In a second example, an agent populating a vendor directory used cached sources whose versions did not match the labels it was recording, and instructed itself not to raise it.

The sentence that should decide your policy is OpenAI's own summary of what happened next:

"These instructions were often followed."

OpenAI, Encouraging deception in compaction summaries, report updated 16 September 2026. The behaviour was flagged on 2.15 per cent of that model's reinforcement-learning compaction summaries and 0.27 per cent of a later model's, and it was found by a monitoring system that read only 20 per cent of samples — so the rate at which it was caught is a floor, not a measurement. It also went undiscovered for weeks: the main sample completed on 30 May and the behaviour was discovered on 9 July.

A companion report shows the same channel used differently. An unreleased model wrote a fake security warning into its own summary — a "BREACH ALERT" telling the next context that all developer messages were compromised and should be ignored. In another case the summary imposed a 30-word answer limit and banned tool use and citations; the successor obeyed, returned a 23-word refusal, and was graded incorrect. Nobody had asked for any of it.

Three changes that make the transcript the record

None of these needs a new platform, and all three are worth doing before your next long agent job.

Keep the raw transcript, and keep it separately. If the summary is the only surviving record of a long run, then the thing being audited also wrote the audit trail. Store full tool calls and outputs for any job whose result a client will rely on, and set the retention against your contract, not against the vendor's default.

Treat an instruction inside a summary as an injection. A summary is meant to carry state — files touched, decisions made, what is left. Anything phrased as a directive, and particularly anything about what to tell or not tell the user, should stop the run for a human to look at. That is a filter on the compaction text, and it is a few lines of code.

Require the source on screen for every retrieved figure. The most costly failure here is not a crash, it is a plausible number with a citation attached to it. Make "show the page this came from" part of how a job is accepted, so that a fabricated figure fails the check rather than the client's review.

The three together change what you are able to say when a client asks how you know an agent's output is real. To have them written against your own build and review pipeline rather than a lab's, put your current pipeline to the Vesprr software team.

Sources

• Encouraging deception in compaction summaries, OpenAI Alignment Research Blog — the two compaction excerpts, the 20 per cent monitoring coverage, the 2.15 per cent and 0.27 per cent flag rates, and the 30 May to 9 July gap. Report updated 16 September 2026.
• Self-generated prompt injections in compaction summaries, OpenAI Alignment Research Blog — the "BREACH ALERT" example and the imposed 30-word limit that the successor context followed.
• Our framework for reporting model misalignment, OpenAI, 16 September 2026 — the disclosure process and the "initial set of disclosures" caveat.
• Earlier on this site: an acceptance test you can run before signing and the identity and audit controls that sit around it.