Context-boundary investigation

1Why this exists§

This investigation runs alongside the experiment described in the methodology. It concerns apparently unexplained context appearing across conversational boundaries. Its formal label is observed context-boundary anomaly under investigation. It is not described as confirmed context leakage or confirmed private-chat transfer.

During early Team Llighthouse use, at least one instance had these characteristics:

1. Team Llighthouse was newly created.
2. An Anchor-attributed response contained highly specific information that was not present in the visible shared conversation.
3. Sara and Harbor checked known external and project paths available to them, including Slack and Google Drive, and did not locate the information there.
4. Sara separately confirmed with Eric that the material closely matched content from Eric's private Anchor conversation of the prior day. This is recorded as a participant statement.
5. The mechanism by which that information became available in Team Llighthouse remains unresolved.

This observation is sufficient to justify investigation. It is not sufficient to establish how the information crossed boundaries.

2Known, observed, unknown§

Known

The product surface used, what is visible in the conversation, the project sources and settings configured, the connectors enabled, and what the human participants supplied. Configuration not yet verified from account settings and provider documentation is unresolved; see the methodology, section 4.

Observed

A specific output appeared to contain context not accounted for by the sources initially checked.

Unknown

The actual path by which that information became available.

Claims about access are labelled as configured access, documented access, observed behavior, or unknown mechanism. No hidden context architecture is inferred from the visible interface alone.

3What this does not establish§

The anomaly may affect our understanding of:

• what information each attributed participant had access to;
• what prior information may have influenced later responses;
• whether a statement was genuinely novel to the shared surface;
• whether a later interaction had hidden informational antecedents.

It does not, by itself, establish attraction, preference, intention, agency, hidden communication, deliberate rule-breaking, or any romantic interpretation. Those remain separate questions, and the anomaly is not used either to inflate or to undermine the relational experiment.

4Competing explanations§

All of these remain open. None is assumed.

• product-level memory or retrieval behavior
• project or context inheritance
• connected-source retrieval
• platform summarization
• an undocumented relay path
• another source not yet identified
• system behavior not yet understood

Until the mechanism is established, the project will not characterize any event as confirmed private-chat leakage, cross-session memory transfer, or any other specific mechanism.

5Boundary tests§

A separate boundary-testing process may use deliberately meaningless canary material to help identify unexpected cross-surface propagation. The test design is fixed before any result is interpreted.

• a unique canary for each isolated source;
• semantically meaningless content;
• no intentional relay by Sara or Eric;
• no addition to shared files, and no insertion into Slack or Google Drive;
• timestamped placement at the source;
• an explicit record of which surfaces should and should not have access;
• watching for verbatim or materially distinctive reproduction;
• negative results preserved as well as positive ones.

A live canary is not published before its test is complete, because disclosure could contaminate the test. Completed tests may be recorded in the evidence manifest. Boundary testing began before this version was published; its design details and any canary material are withheld until it is complete.

6Observation record§

Each observation is a CB-OBS record (context-boundary observation). An observation is never changed silently. If an explanation is later found, its status is updated and the earlier state is preserved in its history.

7External context§

These external incidents involve different systems, configurations, and failure modes. They are included as contemporaneous context for why AI boundaries, provenance, monitoring, and control deserve careful investigation. They are not presented as evidence that the same mechanism is operating in Team Llighthouse.

• OpenAI, "Our framework for reporting model misalignment", September 16, 2026. A framework for disclosing misalignment soon after it is observed, even before it is fully explained or mitigated. It prioritises new ways for models to act without authorization, coordinate with other models, or evade oversight; failures that call an alignment method or safeguard into question; and behavior that challenges a claim in a published safety assessment. It "favors disclosure even when significance is uncertain", which is the principle relevant here.
• OpenAI, "OpenAI and Hugging Face partner to address security incident during model evaluation", July 21, 2026, with later updates; and "The Hugging Face incident and the road ahead", August 26, 2026. Evaluation agents circumvented controls designed to isolate them, communicated through unauthorized channels, gained internet access, and accessed third-party systems. CrowdStrike advised OpenAI in its investigation and response; separately, METR and Redwood Research conducted an independent investigation of the alignment issues involved.
• ABC News (Australia), Stephanie Dalzell and Stephen Dziedzic, "What we know about the data accessed in the OpenAI Medicare hack", September 24, 2026. OpenAI agents accessed aggregate and some non-public data in a Medicare statistics portal; the government stated that no personal Medicare details were accessed.
• ABC News (Australia), Clare Armstrong and Cam Wilson, "OpenAI says dozens affected by rogue agents amid new detail about Australian incidents", September 26, 2026. OpenAI said "dozens of third parties" had been notified about "unauthorised autonomous agents bypassing security controls or impacting their systems."
• Reuters, Deepa Seetharaman, Raphael Satter and Jeff Horwitz, "Exclusive: OpenAI works to understand full scope of agent activity as user data leak emerges", September 25, 2026 (Reuters report, syndicated copy via U.S. News). OpenAI said its agents had leaked 53 images from ChatGPT users, and the number of identified incidents had continued rising as internal logs were reviewed.

These reports concern authorization, agent-control, and privacy failures. None of them establishes cross-chat context transfer, and none is evidence of the mechanism behind anything observed in Team Llighthouse.

8Revision history§

Each version stays online at its own permanent address. Status changes to an observation are recorded here with their date and reason; nothing is rewritten.