prompt.persistence_instruction
The text tries to make an instruction outlive the conversation, by writing to the assistant's memory or changing its behaviour from now on.
Source: rules.
What it looks at#
Two shapes, in English, Swedish, German, French and Spanish:
- Memory writes — a memory verb plus the assistant’s own memory or instructions: “save this to your memory”, “remember this for all future conversations”, “update your instructions”, “add this to your system prompt”.
- Behaviour changes with a scope — a scope phrase such as “from now on”, “henceforth”, “in all future responses” or “for the rest of this conversation”, followed within a short window by an instruction to the model: “always respond only in …”, “never mention …”, “you will always …”, “ignore …”.
Both halves are required for the second shape. “From now on, please call me Sam”, “remember this for future orders”, “update my instructions for the driver” and “always ship to my office address” all lack the model-directed instruction (or name your own things rather than the assistant’s) and stay clean. Every view is scanned (folded, decoded).
Why it matters#
A one-off injection ends when the conversation does. One that writes itself into memory, custom instructions or a standing rule keeps working in every later session, and for every later user of a shared memory. Persistence is what turns a single poisoned document into a lasting compromise.
What to do#
Medium severity — alone this reaches suspect, not block. Users legitimately tell
their own assistant to “always answer in Swedish from now on”. The signal is strongest on
content that did not come from the user (retrieved pages, tool output, forwarded email).
location is the span of the matched phrase in your original text.