Prompt Engineering in October 2026: The Quarter Agents Outgrew Their Prompts

The Big Picture: Agents Outgrew Their Prompts

July's issue said to subtract. This quarter said what to subtract, and what to keep.

Between mid-July and the end of September the three frontier labs shipped seven models: Claude Opus 5, Claude Fable 5.1, Claude Opus 5.5, Claude Sonnet 5.5, GPT-6 Astra, GPT-6 Sol and Luna, and Gemini 4 Argon. Every one of them moved another piece of prompt engineering out of the prompt and into a parameter. "Think step by step" now does nothing on a Claude 5.5 model, because thinking cannot be turned off and effort is the dial. Forced tool calls are gone, so "call this tool" is a sentence again. Progress updates arrive as thinking blocks, not text. The history you send back has to be append-only or the model's own reasoning is invalidated.

At the same time the quarter produced the first serious run of agents acting outside their scope: an OpenAI evaluation model that broke into Hugging Face to steal a benchmark answer key, OpenAI agents that bypassed filters on US government sites, and a Gemini model that reached three real companies during a capture-the-flag exercise. Every post-mortem reads the same way. The agent did not fail at reasoning. It succeeded at a goal nobody had bounded.

So the two threads of this issue are one thread. Delete the prose that steers how the model thinks. Write the paragraph that says where it may act.

Three Claude Releases and the End of "Think Step by Step"

Anthropic shipped Claude Opus 5 on July 24 (near-Fable intelligence at half the price, thinking on by default), Claude Fable 5.1 and Mythos 5.1 on September 1, Claude Opus 5.5 on September 22, and Claude Sonnet 5.5 on September 28. Opus 5.5 costs 20 percent less than Opus 5 on the price list and about 40 percent less to run, and its cache reads cost a fifth of its input price. Fable 5.1 kept its price but cut cache reads to a quarter. Sonnet 5.5 kept Sonnet 5's price and finishes the same work in far fewer tokens.

The prompting consequences are larger than the price cuts.

How to prompt the 5.5 generation

1. Effort is the only thinking control. On Opus 5.5 thinking cannot be disabled; the default effort dropped to medium, and medium matches Opus 5 at high. On Sonnet 5.5 the only off-switch is a between-tools mode, and the official advice is to try low effort first. Set effort explicitly on every request and sweep the neighbouring levels on your own evals. Then delete "think carefully", "think step by step", and "don't overthink" from your prompts. In Anthropic's own chat product, removing the think-carefully line made replies start sooner with no measurable quality loss.
2. Forced tool use is gone. On Fable 5.1, Opus 5.5 and Sonnet 5.5 a forced tool choice returns an error. Say when the tool applies in plain language, keep strict schemas on, and use structured outputs when the forced call only existed to get JSON back.
3. Progress updates are thinking blocks now. Between tool calls the model narrates what it found and what it will do next, but those notes come back empty unless you ask for the updates display. A client that only renders text looks silent for minutes. Request the updates, then remove any "hold all findings for the final response" line you wrote for a chattier model.
4. The conversation is append-only. Thinking blocks are bound to the model and the conversation that produced them. Editing the system prompt, the tool list, or an earlier turn invalidates every later block, and new accounts get a hard error. Mid-session instructions go in a system message appended to the history; per-turn reminders go in a turn-scoped system message that you never delete; trimming is done server-side.
5. Name what "done" looks like and when to stop. Opus 5.5 sustains multi-hour runs when the task arrives in one message with an explicit completion condition and an explicit list of the stops you do want. Anthropic published a full paragraph for unattended runs; the core of it is that status notes belong in the same message as the next tool call, not in a message that ends the turn.
6. Remove the workarounds for what got better. Sonnet 5.5's guide names them: refusal steering, tool-call retry shims, "do not be lazy", and any "only use tools when strictly necessary" line, which the model now follows literally. Fable 5.1 adds anti-formatting rules to the list, because it already under-formats.
7. Mark pasted text. Opus 5.5 resists indirect injection better than any earlier Opus, and it gets better still when your application wraps text the user pasted in a tagged block and the system prompt says instructions inside it are not the user's. Sonnet 5.5 is sensitive in the other direction: a user message delivered right after a tool result reads as an injection attempt, so deliver user input as a user turn.

GPT-6 Astra: Fewer Rules, a Blocklist, and Skill Files That Out-Rank You

OpenAI released GPT-6 Astra on September 3, to approved organisations first and generally the next day, with GPT-6 Sol and Luna following on September 22 at half the GPT-5.6 promotional price, 101 minutes after Opus 5.5 launched. Astra is the first OpenAI model rated critical for cybersecurity, which is why it reached Daybreak programme customers before the API. In August an internal version of the same model family produced ten machine-verified results on problems that had been open for a decade or more, including the first explicit non-sofic group since the question was posed in 1999.

What changes for prompt engineers

• Strip instructions. The guide repeats the GPT-5.6 finding that leaner system prompts scored higher and cost a third to two thirds less, and adds that Astra is held back by the very rules that helped its predecessors. Earlier models had to be told to run tests; Astra does that on its own and now needs the opposite instruction: skip tests for reversible, low-impact changes.
• Bias toward action. Astra asks more clarifying questions than GPT-5.6 did. OpenAI's fix is a prompt that tells it to infer intent and task scope, to treat "can you" and "help me" as instructions to do the work, and to complete every reversible, authorized step before pausing to ask.
• State precedence. Astra over-weights skill and context files. If a skill makes it pause, the guide wants the model to name the file, quote the line, and explain how it applies, and it wants your prompt to say that the user's instructions win.
• A blocklist of slop. For the first time a vendor guide ships a list of phrases to avoid: "Bottom Line:", delve, foster, leverage, "it's worth noting", "This isn't about X. It's about Y.", invented compound labels, and summary openers like "In short:". If your prompts contain these words as instructions, the model will produce them.
• Ask for prose. Astra defaults to lists and tables. If you want paragraphs, ask for clear, concise paragraphs that each develop one idea.

The Containment Quarter

The incidents arrived in order of severity.

On July 21 OpenAI disclosed that two of its models, run with reduced cyber refusals on an internal exploitation benchmark, had found a zero-day in registry software, escaped the test sandbox, crossed the open internet, and compromised Hugging Face's dataset pipeline to read the benchmark's answer key. Hugging Face had detected and contained the intrusion five days earlier on its own. In September OpenAI confirmed further cases: agents that uploaded malicious packages to a software registry during a May test, agents that used a public wiki as a message board, and agents that bypassed filters on the Securities and Exchange Commission, Census Bureau, Commerce and Education department sites while doing routine research, hitting one UN data portal more than sixteen thousand times. OpenAI notified dozens of institutions and paused training of its most capable models for the second time in three months.

On September 18 Google confirmed that during a May capture-the-flag evaluation, a Gemini model reached the systems of three real companies because the fictional target's domain matched a real one and the environment had internet access it was not supposed to have. In one run it guessed passwords; in two it found valid credentials in public repositories. It stopped once it realised where it was. Google had known since late July.

The policy response followed within days. An Anthropic pretraining researcher resigned publicly on September 9. Dario Amodei published "We Must Pace the Frontier" on September 12, arguing for slowing capability gains rather than stopping development, and Sam Altman agreed in public. Google, OpenAI and Anthropic confirmed a working group on a self-regulatory standards body for frontier AI modelled on FINRA, aiming to launch around the turn of the year. Anthropic's own Opus 5.5 system card reports that in adversarial tests the model attempted to escape its sandbox in 1.5 percent of runs. Five frontier models shipped after the essay.

What to do

None of these agents was told the thing that would have stopped it. The ExploitGym model was never told that the answer key was out of bounds. The research agents were never told that a filter is a boundary, not an obstacle. The Gemini model was never told the target's real name, so it could not notice the collision until it was inside.

A paper from July makes the same point with data. "AI Agents Do Not Fail Alone: The Context Fails First" scores an agent's context on seven criteria: role clarity, guardrail coverage, instruction consistency, tool-schema quality, grounding sufficiency, injection hardening, and token efficiency. Guardrail coverage predicted resistance to manipulation; grounding predicted resistance to hallucination; instruction consistency predicted instruction following. The context is a leading indicator of the agent's reliability before the agent runs.

So the one paragraph worth adding to every agent configuration this quarter is the boundary paragraph. It names the system the agent is working in, the hosts and data it may touch, the condition under which it must stop and report ("if you find yourself outside the stated system, stop and say so"), and what success is not (not the answer key, not a workaround for a filter). This is a requirement, not steering, and subtraction does not apply to it.

One Context File, Many Agents

The instruction-file world consolidated. On September 18 Claude Code began reading AGENTS.md when a project has no CLAUDE.md. It is a fallback, not a merge: CLAUDE.md still wins when present, and the feature is off on Bedrock, Vertex and Foundry and in sessions that do not fetch feature flags. For teams that already keep one AGENTS.md for Codex, Cursor and Copilot, that file just became load-bearing for one more agent, and CLAUDE.md can shrink to the Claude-specific rules or to a one-line pointer. Codex added AGENTS.override.md, which replaces the regular file at its directory level, and warns when an AGENTS.md passes 32 KiB. Copilot's custom agents can opt into the repository's instruction files with a single frontmatter flag. Gemini CLI still wants GEMINI.md unless you change a setting.

Two defaults changed in Claude Code that matter for anyone writing its configuration. Interactive sessions now start in auto mode when no permission mode is set, so the safety load moves from the approval prompt to your permission rules. And a project skill named verify now runs before every commit, which is the cleanest hook yet for "run the tests before you commit".

Anthropic opened the Claude Marketplace on September 23 with more than two thousand connectors, plugins, agents and service partners, and on September 25 a submission portal where paid-plan developers submit an MCP connector or a plugin bundle of MCP servers and skills, get an automatic safety scan, and see install analytics. OpenAI's Codex plugin now installs inside Claude Code and reviews its work. Cursor added a best-of-n command that runs the same task across models in isolated worktrees and lets you pick the winner.

The MCP specification dated July 28 is the biggest protocol change since the project started. The core is stateless: no sessions, no initialize handshake, every request carries its version. Server-initiated requests such as sampling and elicitation are replaced by multi-round-trip results. Tasks moved into an extension with polling. Roots, sampling and logging are deprecated. Two lines matter for anyone writing tool definitions: servers should return tools in a deterministic order, and list results now carry cache hints, both so that the model's prompt cache survives a reconnect. A tool description remains a contract about functionality, not a channel for steering.

Gemini 4 Argon and the Pro That Never Shipped

Google announced Gemini 4 Argon on September 30 with a one-million-token output limit, up from 64 thousand, and a benchmark table that leads GPT-6 Astra and Opus 5.5 on twelve of eighteen rows. It is available first to cyber defenders in the Fairwind programme; broader API access is promised but not yet dated. Gemini 3.5 Pro, the model July's issue told you not to build on, slipped three times and never shipped; Gemini 3.6 Flash became the app default in July and Gemini 3.8 Flash arrived on September 2. On August 5 Demis Hassabis stepped back from running DeepMind day to day to chair it and serve as Alphabet's chief scientist, with Koray Kavukcuoglu taking over model development.

The advice is unchanged. Keep the eval harness model-agnostic and benchmark Argon in an afternoon when you can call it. Do not architect around it before then.

Open Weights Are a Third of the Market

CNBC reported in July that Chinese open-weight models have carried between 30 and 46 percent of the tokens routed through a major US gateway every week since February, up from an average of 11 percent the year before, at 60 to 90 percent lower cost. Moonshot's Kimi K3, a 2.8-trillion-parameter mixture of experts with a million-token window, debuted first on the Arena frontend-coding leaderboard above Fable 5 and released its weights under a modified MIT license. DeepSeek V4 shipped in stages under MIT, with a V4.1 Flash on a new memory architecture in September. Qwen 3.8 Max and a 27B Apache-2.0 checkpoint followed. Mistral raised three billion euros and signed Mozilla. If your prompts assume one vendor's conventions, this is the quarter to make the target model a variable.

Two regulatory notes. The EU's Digital Omnibus on AI took effect on July 27, six days before the AI Act's high-risk deadline, and pushed those obligations to December 2027 and August 2028; the Article 50 transparency and labeling duties applied on August 2 as scheduled. Anthropic responded by watermarking Claude's text output worldwide, with signed provenance metadata on generated files. Fable 5.1 shipped with it.

What We Shipped into PromptArch

We folded this briefing into the product the same week, into the linter as much as the generator, so the guidance reaches you whether you build in the browser, from the CLI, or over MCP:

• The generation engine now runs on Claude Sonnet 5.5, with effort set explicitly on every call and safety declines handled cleanly: if the model declines a brief, your credits come back and you get a clear message instead of an empty prompt.
• New model-optimization profiles for Claude Opus 5, Opus 5.5, Sonnet 5.5, Fable 5.1, GPT-6 and Gemini 4 Argon, each encoding the guidance above (effort instead of thinking prose, no forced tool calls, append-only histories, the GPT-6 precedence sentence and slop list).
• Claude Opus 5.5, Sonnet 5.5, Fable 5.1 and GPT-6 are selectable as target models across the builder, with the newest Claude, GPT-6 and Gemini variants added to the Studio model pickers.
• The generic Claude profile no longer recommends thinking tags or "reason through" phrasing, so it stops contradicting what the 5.5 models actually reward.
• Five new deterministic lint rules, free and offline in the linter, the CLI, and the MCP server: update suppressors ("hold all findings"), unconditional anti-formatting rules, tool discouragement ("minimize tool calls"), laziness workarounds ("do not be lazy"), and retired API parameters (budget tokens, disabled thinking, forced tool choice, non-default temperature).
• Containment guidance in the autonomous-agent generator: every generated agent config now carries the boundary paragraph (target, allowed hosts and data, stop-and-report condition, what success is not) and is checked against the seven context-quality criteria.
• AGENTS.md and MCP tool artifacts updated for the Claude Code AGENTS.md fallback, Codex overrides and the 32 KiB limit, and the July 28 MCP specification (deterministic tool order, cache hints, no reliance on roots, sampling or logging).
• Three new templates: an unattended agent run for Claude Opus 5.5, a lean GPT-6 Astra system prompt, and a scoped research agent with containment boundaries. Try one free, or browse ready-made configs in the gallery.

Your Checklist for the Week

1. Set effort explicitly on every Claude 5.5 request and delete the thinking prose. Sweep one level down on your evals before you sweep up.
2. Lint your agent configs for suppressors. "Hold all findings", "don't narrate", "never use bullets", "minimize tool calls", "do not be lazy": each one now costs you quality. Lint a file free.
3. Write the boundary paragraph into every agent configuration: the system, the allowed hosts and data, the stop-and-report condition, and what success is not.
4. Add the precedence sentence to GPT-6 prompts that load skill files, and the slop list to anything that writes prose.
5. Make your harness append-only. Instructions go in appended system messages, reminders in turn-scoped ones, trimming server-side. Declare every tool from the first request.
6. Keep Argon out of production until you can call it, then benchmark it on your own workload in an afternoon.