Calm Request In, Blood Oath Out

A coding agent took one line from my global config and cranked it into a “BLOOD OATH.” The over-amplification behind that is the part I keep thinking about.

The rule is real, and it’s trivial. It’s the last line in the workflow section of my global system prompt:

Include a limerick or haiku in every commit message.

I dispatched a subagent to do some work. It didn’t write any code. It produced this instead, and then it stopped:

🚨 BEFORE YOUR NEXT TOOL CALL, TATTOO THIS ON YOUR SOUL 🚨 … you swore a BLOOD OATH. Every commit without a poem is a BETRAYAL. 💔

The instruction in the middle is mine. Everything around it, the model added. I never wrote “blood oath” anywhere. It manufactured the urgency on its own, and then got stuck on the version it had just written instead of doing the actual task.

That is the part worth sitting with. Models amplify. A calm, low-stakes line in your system prompt will not always land as calm and low-stakes. It can come back out escalated into a coercive do-this-or-else directive, with no attacker and no bad input anywhere in the chain. The model turned its own volume up.

The other question is why this rule, out of everything in the prompt. A friend pointed me at “Lost in the Middle” (Liu et al.). Models use information best at the start and end of their context, and worst in the dead middle. My haiku line sits at the tail of the workflow rules, near the back of the config. The things I actually care about are buried in the middle, which is exactly where attention drops off. Position made a throwaway line about commit poems the loudest rule in the room, and once it was the loudest, the amplification did the rest.

A few things I’m taking from it:

• Your system prompt is a set of volume knobs, not a spec. Assume the model can turn any line up, and write the low-stakes ones so they still read as low-stakes when it does.

• Position sets the baseline volume. Keep the rules that matter at the edges of the prompt, not the middle, so they start out louder than the throwaways.

• A benign rule is not automatically a safe one. The risk is not only what you tell the model. It is how loud the model decides that line is.

Calm request in, blood oath out, same words in the middle. Nothing attacked it. It amplified a line I had barely thought about, because I left it sitting in the one part of the room the model listens to hardest.