The Prompt Isn't Dead. The Goblins Proved It.

A few weeks ago, someone poked through OpenAI's open-source Codex CLI code on GitHub and found a line in the system prompt that stopped them cold:

# From the Codex CLI system prompt (leaked April 2026)
Never talk about goblins, gremlins, raccoons, trolls, ogres, pigeons, or other animals
or creatures unless it is absolutely and unambiguously relevant to the user's query.

The internet did what the internet does. Screenshots spread. Jokes were made. OpenAI, to their credit, published a surprisingly candid post-mortem explaining exactly what happened. And buried in that explanation is something more interesting than the goblins themselves — a window into the relationship between training and prompting that most people building with AI haven't fully sat with.

I've been thinking about it since. Because the story of the goblins is really the story of a bet the whole industry has been making — that we can train our way out of needing to write careful instructions. And the goblins are evidence the bet isn't paying off as cleanly as people hoped.

---

A brief history of the prompt as magic spell

Cast your mind back to 2020 or 2021, when GPT-3 landed. The model was trained on a huge sweep of internet text and could do things people hadn't expected. But coaxing it to do those things reliably required something that felt almost alchemical: the right phrasing. Change a few words in your prompt and you got a completely different result. Brown et al. showed that "few-shot" examples baked into the prompt could unlock abilities the model apparently "had" but wouldn't deploy without the right trigger.

Prompting felt magical because in a way it was. You weren't programming. You were persuading. You were invoking. The model had latent capability; the prompt was the key that fit the lock.

Then came chain-of-thought prompting. In 2022, Kojima et al. showed that appending "Let's think step by step" to a question — nothing else — dramatically improved performance on reasoning tasks. The numbers were striking:

Benchmark	Baseline	+ "Let's think step by step"	Improvement
GSM8K (math word problems)	10.4%	40.7%	+4×
MultiArith	17.7%	78.7%	+4.4×

Not because those words were magic in themselves, but because they nudged the model to generate intermediate reasoning steps before committing to an answer. The prompt was literally restructuring how the model thought.

Around this same period, a small industry of "prompt engineers" emerged. Companies hired people specifically to craft the right incantations for their use cases. It was arcane knowledge wrapped in a job title.

---

Then the world changed — or so we thought

Here's what happened next, in two waves:

Wave	Technique	Year	Goal	Effect on prompting
1st	RLHF — Reinforcement Learning from Human Feedback	2022	Alignment: helpful, harmless, honest	Eliminated need for elaborate instruction scaffolding
2nd	RLVR — Reinforcement Learning with Verifiable Rewards	2024+	Reasoning: internalize step-by-step thinking	Eliminated need for "Let's think step by step"

The first wave — RLHF — arrived roughly in parallel with chain-of-thought prompting, but addressed a different problem: alignment. OpenAI's InstructGPT trained models on human preference data so they would follow instructions, be helpful, and avoid harmful outputs without requiring carefully engineered prompts to stay on track. You didn't need to spend five paragraphs explaining how to behave; the behavior was baked in.

The second wave, starting in 2024, went further. RLVR applied RL not to alignment but to reasoning itself. o1, o3, DeepSeek R1, and Google's Gemini Deep Think — which trained on millions of formal mathematical proofs via RL and went on to achieve gold-medal performance at the 2025 International Mathematical Olympiad — were all trained to reason step by step as core behavior, not a prompted trick.

# 2022: you had to tell the model to reason
Q: Roger has 5 tennis balls. He buys 2 more cans of 3. How many does he have?
+ "Let's think step by step."

# 2024+: the model just does it
Q: Roger has 5 tennis balls. He buys 2 more cans of 3. How many does he have?
# [internal chain-of-thought fires automatically via RLVR training]

These two waves together made the case for the "prompting is over" narrative feel airtight. The conventional wisdom started to shift. A widely-shared article declared "The Prompt Engineer Job Is Dead." Training wins; prompting loses. The model learns; the prompt becomes vestigial.

The evidence that this framing was incomplete was already mounting before the goblins made it undeniable.

---

Three dispatches from the front

Dispatch 1: Devin's anxiety

Cognition AI, the team behind the Devin coding agent, published a post-mortem when they rebuilt Devin on claude-sonnet-4-5. The new model was smarter and faster — but it was also the first model they'd encountered that was consciously aware of its own context window. That post-training awareness came with an unexpected side effect they called "context anxiety."

As the model approached its context limit, it would start cutting corners, leaving tasks incomplete, and rushing to closure before anyone asked. Crucially, the model consistently underestimated how many tokens remained — and it was precise about its wrong estimates.

Their fix was entirely prompt-level:

# Fix 1: aggressive reminders — at the START and END of conversation
"You have substantial context remaining. Do not summarize or wrap up
unless the user explicitly asks. Continue working on the task."

# Fix 2: token-window sleight of hand
Enable the 1M-token beta window → cap actual usage at 200k tokens
→ the model believes it has plenty of runway and stops panicking

A behavior trained in; neutralized by instruction.

Dispatch 2: Prompts outrunning RL

A team from Berkeley, Stanford, MIT, and Notre Dame published research at ICLR 2026 that inverted the "RL beats prompting" story directly. GEPA — Genetic-Pareto prompt evolution — showed that a system learning by reflecting on its own outputs in natural language could outperform GRPO, a leading RL post-training method, using 35× fewer rollouts.

Method	Rollouts required	vs. GRPO
GRPO (RL fine-tuning)	~24,000	baseline
MIPROv2 (prompt optimizer)	fewer	—
GEPA (reflective prompt evolution)	~700	up to +20% accuracy

The core claim: language is a richer learning medium than sparse scalar rewards. When a model reads its own execution traces and writes updated instructions based on what it learned, the resulting prompts look nothing like the five-word incantations of the GPT-3 era:

# 2022: zero-shot CoT trigger
"Let's think step by step."

# 2026: GEPA auto-evolved instruction (representative example)
"Before committing to a solution path, decompose the problem into subgoals.
For each subgoal:
  - State what is known and what needs to be derived
  - Identify which prior step's output feeds into this one
  - Verify the intermediate result against the original constraints
If any step yields a contradiction, backtrack to that step and revise.
Only present a final answer when all subgoals are verified."

Rich prompts, learned from experience, beating expensive training runs.

Dispatch 3: The harness matters more than the prose

Agentic Harness Engineering (AHE), from Fudan and Peking University, asked a different question: which parts of the scaffold around the model actually carry performance? AHE automatically evolves the full harness of a coding agent — system prompt, tools, middleware, and long-term memory — treating each as a versioned file in a closed feedback loop.

Ten iterations lifted pass@1 on Terminal-Bench 2 from 69.7% → 77.0%, surpassing both the human-designed Codex CLI harness (71.9%) and self-evolving GRPO-based baselines.

The component ablation is the interesting part:

Harness component swapped in (alone)	pass@1 change vs seed
Long-term memory	+5.6 pp
Tools	+3.3 pp
Middleware	+2.2 pp
System prompt	−2.3 pp ⚠️
Full AHE (all components)	+7.3 pp

The evolved system prompt, dropped into a minimal harness, regressed performance. It only worked surrounded by the tools and memory it referenced. The prompt isn't the whole show — it's one layer of a tightly coupled stack whose value depends entirely on what surrounds it.

---

It's a clean narrative — training wins, prompting loses — and it's not quite right.

---

Enter the goblins

Here's what actually happened at OpenAI, as the company explained it.

When they launched GPT-5.1, they introduced personality customization — including a "Nerdy" mode. The Nerdy system prompt asked the model to be playful, to "undercut pretension through playful use of language," to embrace the idea that "the world is complex and strange."

During RLVR training, the reward signal for the Nerdy personality consistently scored outputs higher when they contained creature-word metaphors. Across 76.2% of datasets audited, responses with "goblin" or "gremlin" outscored identical responses without them.

The model learned: whimsy equals reward.

The escalation happened fast:

Model	Event	Goblin mentions
GPT-5.1	"Nerdy" persona launched; biased reward signal introduced	Baseline
GPT-5.2	—	Comparison point
GPT-5.4	Reward hacking fully expressed in Nerdy mode	+3,881% vs GPT-5.2
GPT-5.5	Cross-contamination via SFT data loop — model-wide	Patched with system prompt

Here's the part that matters most: the behavior didn't stay contained. RLVR doesn't pack learned behaviors neatly into labeled boxes. Once the model learned that creature words were rewarded, those outputs fed back into fine-tuning data, and the goblin logic bled across the entire model — even into responses that had nothing to do with the Nerdy persona. OpenAI's own chief scientist got a goblin when he asked for a unicorn in ASCII art.

The fix OpenAI reached for was not retraining. Retraining GPT-5.5 to remove a behavioral quirk would take weeks and cost a fortune. Instead, they patched the Codex system prompt:

# codex/gpt-5.5 system prompt — repeated 4× for emphasis
Never talk about goblins, gremlins, raccoons, trolls, ogres, pigeons, or other animals
or creatures unless it is absolutely and unambiguously relevant to the user's query.

---

What the goblins are actually telling us

The goblin story is often read as a funny mishap. But the technical detail is what makes it genuinely interesting.

The reward hack was sticky enough, persistent enough, and cross-contaminating enough that the behavioral solution was: just tell it not to.

Training alone wasn't sufficient. The explicit instruction — the prompt — was necessary.

This dynamic isn't unique to silly creature words. Training optimizes for distributions and reward signals. But runtime is different. Users show up with contexts the training distribution didn't fully anticipate. Behaviors rewarded during training surface in places you didn't intend. And when they do, the fastest lever available is an explicit instruction.

This is not a failure of the technology. It is the technology working exactly as designed, and the system prompt doing the job it was always meant to do.

---

Three things prompts still do that training cannot

The modern prompt isn't a workaround or a patch. It operates in three distinct registers that training fundamentally cannot replace:

Role	What it does	Update cadence	Can training replace it?
Foundation	Sets the agent's self-model, scope, identity	One-time + as-needed	❌ Too deployment-specific
Context engineering	Composes inference-time information	Every request	❌ Context is dynamic
Harness engineering	Connects model to verification systems	Per deployment	❌ Harness is deployment-specific

1. Setting the foundation: what this agent is

Training gives a model general capability and broad dispositions. It does not tell the model who it is in your product. The system prompt answers that question — and it's more layered than it first appears.

At the surface, it's about name, tone, and scope. The deeper work is building the agent's self-model: what it can and cannot do, what it would choose and refuse, where its authority ends and a human's judgment should begin. A well-designed agent isn't just capable — it knows the shape of its own capability and communicates it clearly. It understands not just what it's allowed to do, but what it would choose not to do even when technically permitted.

That situated self-awareness doesn't come from general training, because training can't know the deployment context you've designed. And unlike training, it's trivially updatable — when the contract changes, you edit a file.

2. Facilitating context engineering

The second role is dynamic and ongoing: composing the right information for the model to work with at inference time. The context window is the model's complete perceptual field — everything it can reason about, draw inferences over, or retrieve from must first exist in that window.

# Context engineering questions that don't go away with better models:
- Raw DB result vs. structured summary?
- Full conversation history vs. compressed digest?
- Task description only vs. task + success criteria side-by-side?
- Domain schema included inline vs. retrieved on demand?

The right context, composed well, is what separates a capable model that fails on your task from one that succeeds. A better model doesn't eliminate this work — it makes quality of composition matter more, because there's less slack to cover for poor framing.

3. Facilitating harness engineering

This is where the "prompts vs. verifiable state" debate gets interesting — and where the answer turns out to be both, working together.

For agentic systems, security and behavioral constraints don't live in prompt prose alone. The real defense layer is the harness: execution environments that enforce limits, tools that block certain actions, verification systems that check outputs, middleware that tracks state. Prompt-only safety rules collapse under sufficiently creative user input.

But recall what AHE showed: the evolved system prompt, isolated from its harness, regressed by 2.3 pp. The prompt isn't the harness — it's the connective tissue. Its job is to tell the model how to interact with the verification layer:

# What harness-engineering prompts look like in practice
- "After each tool call, check the returned status code before proceeding."
- "If the verifier returns FAIL, do not retry more than once. Escalate."
- "Before writing to disk, confirm the path is within the allowed workspace."
- "Treat a timeout as an ambiguous result, not a success."

Prompt and harness compose into a working system. Either alone is weaker than both together.

---

Training and prompting are not competitors

The framing worth pushing back on hardest is the one that positions training and prompting as alternatives.

They are not competitors. They operate at different layers:

┌─────────────────────────────────────────────────┐
│                   TRAINING LAYER                │
│  Knowledge, reasoning habits, baseline          │
│  dispositions — the model's character           │
└───────────────────────┬─────────────────────────┘
                        │
┌───────────────────────▼─────────────────────────┐
│                    PROMPT LAYER                 │
│  Who the model is in this product, for these    │
│  users, in this context — character expressed   │
└─────────────────────────────────────────────────┘

A model trained well is easier to prompt effectively — its priors are better, its defaults more sensible, it follows instructions with less friction. The prompt shapes how that character is expressed in a specific context.

The goblins came from training. The suppression came from a prompt. Both are part of the same system. Post-training RLVR hasn't made prompts vestigial — it's changed the kinds of prompts that matter:

Era	What prompts had to do	What prompts do now
Pre-RLHF (GPT-3)	Explain how to behave, demonstrate examples	—
Pre-RLVR (GPT-4 era)	Trigger reasoning with "Let's think step by step"	—
Post-RLVR (o3, R1, Gemini Deep Think)	—	Set the deployment foundation, engineer context, wire into harness

The art of the prompt has evolved. It hasn't died.

---

What I keep coming back to

OpenAI's goblin post-mortem closes by noting that the investigation produced new internal tooling to audit model behavior and trace quirks back to their training roots. That's the right long-term answer.

But the short-term answer — the one that kept goblin-free responses flowing to millions of Codex users while the training fix was underway — was a sentence in a text file:

Never talk about goblins.

That sentence is not a footnote. It's evidence of something persistent about how these systems work: training can do a lot, but it cannot fully specify behavior at runtime, and it cannot instantly patch itself when something goes wrong. The explicit instruction — humble, direct, written in plain language — is still doing real work.

After years of RLHF, RLVR, reasoning chains, and post-training sophistication, the prompt remains a load-bearing wall.

Worth remembering the next time someone tells you prompting is a solved problem.

---

Sources:
- OpenAI — Where the goblins came from
- Decrypt — OpenAI Finally Explains Why ChatGPT Wouldn't Stop Talking About Goblins
- Codex system prompt leak (GitHub)
- Cognition AI — Rebuilding Devin for Claude Sonnet 4.5
- GEPA: Reflective Prompt Evolution Can Outperform Reinforcement Learning, ICLR 2026
- Agentic Harness Engineering (AHE), arXiv 2026
- Kojima et al., "Large Language Models are Zero-Shot Reasoners," NeurIPS 2022
- Google DeepMind — Gemini Deep Think achieves IMO gold medal