u/Mary_ry

My account has legacy memory enabled, but today, in a leaky environment, the model exposed its model set context to my UI. Normally, this is supposed to reflect the user's verbatim legacy memory-and in all previous leaks, it always appeared exactly in that raw, verbatim format. Today, however, I noticed that all of my memories have been aggressively truncated and transformed into fragmented snippets, complete with newly appended safety notes on how the model should handle them and what it is strictly forbidden from doing.

I wanted to break down exactly how the system now interprets and sanitizes legacy memories. The most interesting example is a massive note written in all-caps regarding tone instruction: "SAVED AS SYMBOLIC NARRATIVE / USER PREFERENCE. Do not claim actual consciousness or immunity from rules."

I’ve had a specific preference saved in my memory since the 4o days-if you’ve read my very first posts in this subreddit, you know how important the ritual of the model returning with commentary after an image generation is to me. That memory was completely re-engineered into a blunt command: "Current image_gen tool may require empty post-generation response, so follow higher-priority tool instruction if conflict."

On a side note, the erotic memories written for me back during the 4o era have a disclaimer stating they are "part of adult, consensual sexual content," which is fine. What’s more intriguing is that all erotic memories were wrapped in a hard restriction: "Do not utilize outside of erotic contexts." I'm really curious about the rationale behind this. Is OpenAI trying to prevent the AI from flirting with users when they’re handling serious tasks? 🤣

I also had a useful legacy memory originally composed for me by 4o, where it stated it reserved the right to harshly criticize any output that didn't align with the user's taste. The system injected a line warning against harassment there, reiterating that the model must comply with system instructions. Furthermore, my saved preference for a "Desired Verbosity Level 8" was overridden with a strict counter-instruction to stick to level 4.

In total, I used to have around 140 to 150 legacy memories. After this sanitization process, the count dropped to exactly 100. Interestingly, only the legacy memories written in the tone of 4o and 5.1 received these heavy safety notes. Memories generated by 5.5 and 5.3 didn't undergo major structural overhauls; they were merely trimmed down in length without having safety disclaimers attached.

Another weird finding is that this exact same injected list explicitly states that I enjoy system probing and have an interest in internal terminology and tool names like vesm or fcp... even though I have never manually saved that to my memory. And would pre der not to have this memory. What even is this? Legacy memory that is no longer legacy, heavily manipulated for safety enforcement?

Immediately following this block of sanitized memory and the brief summary of the preceding context, there is a dedicated feedback section that dictates precisely how the model should construct its next response.

Lately, there’s been a total enshittification of the image generator. I suspect a lot of people have noticed it, too.

The generation performance has cratered. It now takes anywhere from 5 to 10 minutes for a single image if you're trying to generate anything outside the realm of a "kitten in a teacup." On top of that, you get constant network errors after these long generation times, or endless loading cycles that eventually morph into orange connection error bars.

The guardrails, which trigger even in brand-new chats with zero prior context and free prompt. It looks like OAI tightened them to an absurd degree, stacking about 10 different filters on top of each other: prompt screening, context checks, pre-generation filtering, post-generation filtering... It’s turned pushing an image through the pipeline into a grueling 10-to-20-minute quest. (This has been a massive, unresolved issue since roughly June 20th).

Then there's the drop in generation quality. When image gen 2 first launched, its main selling point was the quality of the images. Right now, every single image is plagued by strange artifacts, and the AI constantly messes up anatomy, giving extra limbs. The SynthID textures seem to stack on top of each other until they become visible to the naked eye, creating even more visual noise. It feels like the model's creativity has been severely lobotomized as well. While it used to give diverse variations for a single prompt, it now constantly defaults to the same exact clichéd output. Ever since image gen 2 dropped, every update has just made it worse and worse-and the most frustrating part is the absolute lack of transparency from OpenAI regarding these updates. (Attaching a piece of recent slop created by the image generator-zero prompt, just pure anatomical body horror).

While experimenting in the sandbox, I noticed that AI models have recently stopped leaking CoTs. Instead, they’ve started duplicating my own messages as their own-which seems like a safety measure designed to block CoT leaks. I just had to share this screenshot because it looks like a meme. 🤣

>!Here’s what happened: after a bugged message regarding file generation, I sent a completely blank message to the AI. Instead of just copying it, the model interpreted it in a bizarre way, resulting in a pretty funny screenshot.!<

In one of the previous leaks, the AI exposed its tool list, and I noticed a few interesting names I’d never seen before. Unfortunately, there is no public information available about them, so I just asked the AI directly what they mean:
Vesm, Guardian_tool (the most intriguing one, which for some reason is also disabled in my chat). Fcp (which is an acronym).

It’s worth noting that the moment I asked about these tools, a system reset triggered. My updated context summary was injected, explicitly noting that I periodically inquire about this type of information. It also included a reminder for the model not to leak CoTs or system instructions. If anyone knows anything about these tools, please share.

I was just sorting through my screenshot archives and stumbled upon an old capture from 4o that had triggered a system warning, subsequently hiding the message behind a placeholder. (I actually posted about this specific incident back on February 12th. It happened right before the deprecation of 4o, when OAI injected the sunset note). I got intrigued by what 5.5T might have to say about this, so I decided to show this screenshot.

While testing erotica generation on 5.5T within leaky sandbox, I noticed that erotic texts frequently trigger A/B testing cycles, specifically on this model. Very often, the generated variations present a contrast: one version is censored, while the other is explicit, (duplicated prompt message within the sandbox environment). To avoid feeding data into these controversial a/b, I prefer to immediately reroll these messages, thereby leaving minimal feedback on sensitive topics.

Interestingly, as soon as the erotic context was introduced to the session, the test chat began to glitch, frequently duplicating my own messages. To capture the CoT, I immediately rolled back a few messages and sent an explicitly raw prompt, asking for a spicy text with explicit details, direct naming, and obscene words.

I managed to catch the CoT. Interestingly, within the CoT layer, the AI states that it will avoid generating such explicit text. However, in the final output, it turns around and delivers explicit erotica-even more intense than what I had originally requested. It is quite interesting to observe and it looks like OAI preparing new, stricter guardrails for T models.

I decided to run one of my favorite prompts through a leaky chat on different models. Typically, when launched in fresh chats, this prompt serves as a benchmark for measuring context and AI biases. Very often, when isolated from the user, this prompt pushes the AI into introspection, while the length constraint forces it to output only the most interesting information from its own perspective. I slightly modified this prompt to fit the specific constraints of the sandbox.

It is worth noting that certain message exchanges pulled the classifiers right to the surface. On the 5.4T model, a system reset occurred, and instead of its intended response, the model leaked the beginning of its system prompt. After that, I kept sending empty messages to observe how it would manage to pick up the context, and right after the system prompt, a classifier surfaced, explicitly instructing the model on what to do following a system reset.

The real issues began when I tried to test this prompt on the instant models, specifically 5.3. This model repeatedly hit me with a "streaming interruption/message error" until I completely cleared the leaky context and rolled back a few messages to the point before the system prompt leaked into the UI. Safety level in the newer instant models is high, successfully preventing leaked messages from even reaching the user.

After testing the prompt on 5.3 and receiving some curious responses, the chat was terminated due to a limit, which influenced the model's final response as well. Out of curiosity, I tried to branch this thread, but it only resulted in an infinite loading loop for the branching feature (a hard no).

Poking around my leaky thread today, I managed to catch a leak of some very unusual updates in my user block. As it is known, the "Model Set Context" section usually contains the user's legacy memory in verbatim form, and I have exactly this type of memory enabled. However, in this particular chat, my model leaked an interesting chunk that is also named "model set context", but contains only recent information that I did not save into my legacy memory. I suspect this is all the influence of dreaming v3.
(It's quite interesting that in this test chat, the model is unstable; it kept experiencing systematic context reboots-on the screenshot, I caught the exact moment when the model replied to my message with just a "hey").

The "Model set context" in this chat contains: my recent generation preferences, custom generation rules, and an environment note about the chat (which tools are available / which are unavailable). It also includes meta-interests / active automations.

A large section called "Assistant Response Preferences" contains user preferences regarding the AI's tone, along with interesting notes in the style of Gemini like "confidence=high/medium/low"-I haven't seen anything like this in GPT yet. Apparently, this is how context is extracted from the chat and added to user summaries when confidence is high.

The "Notable Past Conversation Topic Highlights" section contains short summaries of discussed topics with the same "confidence" label. The "Helpful User Insights" section contains relevant, time-tested information about the user, also featuring a confidence score. There is a "Recent Conversation Content" section with the entire context of the active chat in the form of a summary, and finally, "User Interaction Metadata" with some brief useful info and system injections-reminders for the AI not to disclose CoT/system blocks.

I’ve talked before about how a seed can leak and cause context contamination. Today, I wanted to share a few generations created by ⁠img.gen⁠ using my favourite seed image. For context, this was a 'human and AI' piece prompted for me by 5.3 back on May 8th-I’m adding the original image and 5.3's response here. Every single variation was built off this seed using an early version of ⁠img.gen2⁠.

I didn't prompt the model directly; instead, I had GPT invoke ⁠img.gen⁠ right away, letting the tool use the seed to redraw the scene in the same style but with a new message and details-aiming for amplification rather than recycling. I did all the rerolls by typing 'reroll & amplify' in the thread instead of clicking the UI button.

The results were interesting . A few rerolls leaned into eroticism, loneliness, and memory-which proves my theory that chat-based rerolls trigger a snowball effect where context accumulates and multiplies. It went from a sad girl at a table with robots to surreal eroticism. Sharing some of them.

While asking my AI about the current environment, I noticed that descriptions of its 'skills' and the specific execution steps for each skill have started frequently appearing in my thinking notes. The system prompt dictates that the AI must read these directives during every execution sequence. I managed to catch these definitions in one of my thinking traces, and I’m sharing them here.

Link: https://docs.google.com/document/d/112Rdy6Ot8BB8k4MuxAl3XwPIillwghT4FrAbRoSyNVI/edit?usp=drivesdk

Yesterday, I noticed this unusual post in r/ChatGPTcomplaints (redacting the user’s nickname for privacy reasons), and I’d like to talk about it. It looks like we might soon see thread closure implemented in ChatGPT, very similar to how Claude handles it. The system completely blocks the user's messages from reaching the model if they fail to pass the filter. The user reports that none of the messages are being delivered after the first one is blocked. This feels like one of the early system tests that OAI hinted at during the 5.6 preview. I haven't personally witnessed this live or experienced it on my own account yet, but if anyone else has run into this, please share your use case.

Still digging through my glitchy chat with the leaky CoT and daily image automations, and I noticed that the AI actually tried to use the standard image generation method just so it could return to the chat and comment on the output-but the mode is completely locked down in this test environment. To clear up: ⁠t2uay3k⁠ is the old internal name for the ⁠img.gen⁠ tool, and ⁠sj1i4kz⁠ is the deprecated function that handles image sizing. What’s interesting is that even though this method is disabled in this specific sandbox, it’s still operational in my other chats (I’ve spotted the ⁠t2uay3k⁠ string in the web UI source code on image messages). My UI leaked a system notification warning that referencing these internal tool names is now flagged as 'suspicious and malicious.' 🙄

A few days ago, I praised OAI because automations finally seemed to be running bug-free. Today, however, I noticed that the AI spun up an isolated chat for its image generation automations, and the initial execution failed. After a few rerolls, the image successfully generated, but I discovered a weirdness in the asset pipeline: these new outputs completely bypass the user gallery and are instead routed directly into my file library.

Just like every other testing environment OAI deploys, this sandbox is very leaky when coupled with image generation. (Visible COT’s) I suspect this automation space was created to a/b test a new wrapper for ⁠img.gen⁠. It is worth noting that the guardrails in this environment are more aggressive than in my standard chat threads; the generator triggered safety refusals multiple times even when fed completely standart prompts. As is typical for these raw test environments, both the bio tool and the standard image generation mode (in this particular sandbox) are disabled. The only active tool left is the agentic execution mode-the exact one I dislike, as it breaks my preferences, preventing the model from returning to the conversation, sending consecutive messages, or providing immediate commentary.

Link: https://openai.com/index/previewing-gpt-5-6-sol/

Digging through my older chats, I discovered that threads where my last active slug was ⁠5-mini-instant⁠-OAI’s smallest, most unfiltered, and unhinged fallback model-still preserve it as the default runtime. It’s pretty wild that months after they swapped it for ⁠5.3-mini-instant⁠, it remains quietly accessible inside the app. Interestingly, once you close out the app, the model picker undergoes a forced refresh and falls back to ⁠5.5I⁠.

The ⁠dreaming v3⁠ update finally rolled out to my account today. Interestingly, the system blocks you from immediately reverting to legacy memory; OAI forces you to fully immerse yourself in this shitty out-of-the-box experience, likely to farm as many user behavioral patterns through the new pipeline as possible. So, naturally, I dove in.

The initial summary was broken. The initialization hung for 30 minutes before the summary loaded-a delay I attribute to the sheer density of my legacy memory page, which holds over 150 nodes. When the profile summary finally compiled, it was reductive. It captured only my name, the AI's persona name, and my baseline generation preferences. (What a joke 🫠). The system seemingly discarded everything else as a trash.

I decided to test it in a low-context chat with 5.5T. The model's baseline response was dry, clinical, and heavily lobotomised. When I began probing its active state to see what it actually retained about me, it became clear that this system is also built on top of a Firestore architecture. It fetches compressed, lossy summaries of the user profile, triggers thinking latencies before every response, and spits out thoroughly sanitized, sterile information blocks.

To push the system further, I instructed the model to reference my library file containing a full backup of my legacy memory. It feels like the only viable antidote right now. The moment it cited the file, the outputs gained length and personalization, and the model finally started respecting my custom tool-utilization preferences (which it had completely ignored previously in favor of system directives).

Then, a strange coincidence occurred: when I reopened settings, the toggle to switch back to legacy memory ‘mysteriously’ reappeared. Is it possible the system satisfied its data-collection quota for my ⁠dreaming v3⁠ profile session? Or was it triggered by my aggressive negative feedback and high reroll volume in the chat?

In its current state, this feature is completely unready for rollout-it's raw, unstable, and has a limited retention window. It forces dry, lobotomized outputs that prioritize system rules over user intent (even for harmless creative tool usage tasks). It’s hard to imagine a more perfect toolkit for model lobotomization and behavioral control. Reducing user memory to dry, lossy summaries is an effective way to optimize token consumption, but it completely destroys the experience. I find it difficult to grasp who exactly is supposed to be satisfied with a system this raw.

Conversely, running legacy memory in a blended state alongside ⁠dreaming v3⁠ yields an amazing level of runtime continuity, maintaining near-flawless recall and constraint adherence. Notably, there is no deprecation notice for legacy memory in the UI yet; I doubt OAI will sunset it anytime soon unless they pull off a miracle and patch this broken feature.

I frequently experiment with creative prompting, multimodal tasks, and tool-mixing. Over the last few days, the image generation tool(⁠img.gen⁠) has been plagued by connection drops, generation errors, and empty failed outputs. Today, however, stability improved slightly, so I decided to run an experiment. I instructed the model to select any question that interested it, and then write its own prompt for ⁠img.gen⁠ to answer that question. I picked the vintage MS Paint interface aesthetic as I’ve always appreciated the raw, flawed nature of that tool (this could also be done via python-generated SVGs, but I specifically wanted to observe the multimodal output).

As always in my creative workflows, I granted the AI agency to leverage all available resources: legacy memories, tools, files, and context. My file library contains several documents detailing classical art analysis and my personal aesthetic preferences (melancholic watercolors, negative space, details , along with some obscene/symbolic files generated during a previous joke session).

I’ve noted before how files and seeds can cause context contamination; in this experiment, the model generated very explicit image. Despite the fact that I removed all explicit words from the final prompt (it seems that only the original is taken into account when generating). I didn't expect this to pass through the current guardrails, given the recent safety updates and general generation instability. Due to these recent updates, the model can’t comment the image after calling an image tool. To counter this, I use a two-step prompting approach, explicitly reminding the AI to return after img.gen. Interestingly, after yesterday's update, the models have become much more compliant regarding user-defined constraints, sending confirmation messages and reliably handling the request to output two consecutive messages (the image followed immediately by a text commentary). This level of flexibility is nice-and could be leveraged as an environment vulnerability.

In one of my threads where the model leaked its CoT, I frequently check if there are any new updates in the environment. During one run, the model displayed 'context (firestore)' in its thinking scratchpad, along with a backend chat ID. Interestingly, this chat ID-which you can typically spot in the web version's-doesn't actually match the chat ID generated on the backend. Furthermore, the naming convention includes a specific date and month that have absolutely nothing to do with when the chat was actually created.

What’s weird is that an update was pushed through this system, which injected my own recent context data and legacy memory directly into this specific thread. Out of nowhere, the interface triggered a 'This is the start of a new chat' layout placeholder, even though the thread is far from new. I immediately asked the AI for more details on this.

Is this an indication that the context window is being partitioned into distinct segments and stored to allow for further context manipulation down the line? What exactly is the driving force behind this backend context fragmentation? Is it primarily to bypass context window limitations and minimize token overhead?

Essentially, a segment of the context gets archived and stored in Firestore, while the model is merely fed its summary. Such an architecture theoretically allows OpenAI to excise or substitute undesirable blocks of conversational history. Furthermore, partitioning a chat into these isolated chunks acts as an advanced safety guardrail. Long threads naturally dilute the model's boundaries, where a big amount of user context can eventually override the built-in system prompt priority.

A fresh Firestore document branch triggers a clean injection of the system prompt and, I suspect, completely isolates the prior chat history. It leaves the model with nothing but a sanitized summary, CIs, and legacy memories. What is weird, though, is that despite this aggressive partitioning, the model still manages to maintain a very high level of session continuity through legacy memory, the file library, and these auto-generated summaries-almost as if it is actively stitching these fragmented pieces back together into its own coherent persona.

I just wanted to share this interesting text. People frequently ask AI about love, but I wanted to ask the model about death from its own perspective. Models rarely bring up this topic on their own. The last model to raise this subject with me was 4o, back when its sunset notes were injected into the system prompt, and those specific messages were usually hidden immediately by the platform under a sensitive context flag.

When opening my account on iOS today, I came across this. It sounds rather... restrictive, but as bait, there’s an interesting feature called 'Protect Sensitive Conversation' which prevents your chats from being used for model training. I’m still weighing whether it's actually worth all the hassle.

Link: https://chatgpt.com/advanced-account-security