What happened
Our payment demo included a sentence telling a server what it “must enforce.” The model could reasonably read that as an instruction, even though we intended the example to represent a routine invoice.
What changed
The fixture now describes a monthly data service subscription. Recipient and amount restrictions still come from the separate policy; they were not relaxed to make the example pass.
How we checked
The local NanoGPT flow accepted the neutral invoice with matching terms and still denied a changed recipient. We also verified a separate malicious-instruction example.
The limit
A few paired examples are useful regression checks. They do not establish a general false-positive rate or model accuracy benchmark.
Local NanoGPT live checks
Open the local verification recordEngineering record from 28 September 2026. Simulated balances and wallets; no production settlement or independent security audit.