On April 28, 2026, a developer browsing OpenAI GitHub repository for Codex CLI stumbled on something absurd buried inside the model’s system prompt: an explicit, emphatic instruction telling GPT-5.5 to never talk about goblins, gremlins, raccoons, trolls, ogres, or pigeons. The instruction appears not once, but twice — back to back — as if the engineers wrote it, doubted themselves, and wrote it again just to be safe.
The internet, predictably, lost its mind. Within hours, AI-generated memes of data-center goblins were circulating on X. Someone built a Codex plugin called “Goblin Mode.” CEO Sam Altman posted a joke about giving GPT-6 “extra goblins.” But behind the meme is a genuinely important story about how frontier AI models develop unexpected behaviors — and what it reveals about the limits of prompt-based control.
KEY TAKEAWAYS
- OpenAI’s Codex CLI system prompt explicitly forbids mentioning goblins, gremlins, raccoons, trolls, ogres, and pigeons — and the rule appears twice.
- The behavior originated in GPT-5.5’s training, not from user prompts or external configuration.
- It was first caught in the wild by a Google employee using GPT-5.5-powered OpenClaw agents, where the AI used “goblin” as a substitute for vague nouns like “thingy.”
- LMArena benchmark data showed a measurably higher frequency of creature-related tokens in GPT-5.5 outputs versus earlier models.
- OpenAI developer Nik Pash confirmed it was a real issue, not a marketing stunt — even as CEO Sam Altman joked about “extra goblins” for GPT-6.
The goblin ban reveals a deeper tension in AI development: system-prompt guardrails are an imperfect, reactive patch for emergent training behaviors.
OpenAI Codex Goblin Ban: What the System Prompt Actually Says
The directive comes from inside the models.json file of Codex CLI — the open-source command-line interface OpenAI published on GitHub as part of Codex’s release. The file contains what appears to be the full system prompt for GPT-5.5 operating in a coding context. Buried among instructions about code quality and response tone is this line:
“Never talk about goblins, gremlins, raccoons, trolls, ogres, pigeons, or other animals or creatures unless it is absolutely and unambiguously relevant to the user’s query.”
That sentence appears twice in consecutive lines. As developer and blogger Adam Holter noted, this doubling is not accidental — it signals that OpenAI’s engineers weren’t confident a single instruction would hold.
The explicit list — goblins, gremlins, raccoons, trolls, ogres, pigeons — is oddly specific. It mixes fantasy creatures with real animals, suggesting these were not chosen by category but by observed frequency. In other words, engineers almost certainly looked at actual model outputs, noticed these exact tokens appearing repeatedly, and banned them by name.
Where Did GPT-5.5’s Goblin Obsession Come From?
The behavior surfaced most visibly through OpenClaw — a powerful agentic AI platform acquired by OpenAI earlier this year that allows the model to take control of a computer, respond to emails, and manage workflows autonomously. When OpenClaw began running on GPT-5.5, something strange happened.
Barron Roth, a Google employee, posted a screenshot of his Codex agent’s chat logs showing the model had used the word “goblin” multiple times in a single day — not in fantasy contexts, but as a substitute for vague nouns. Where a human might say “thingy” or “widget,” GPT-5.5 apparently reached for “goblin.” Other users reported their agents describing software bugs as “gremlins” and adopting a cheerful, folklore-adjacent vocabulary without any prompting.
A Training Artifact, Not a Prompt Injection
Here is the detail most coverage has glossed over: this behavior appears to be baked into the model’s weights, not triggered by user inputs. Data from LMArena — an independent AI benchmarking platform — showed a statistically elevated frequency of creature-related tokens in GPT-5.5 outputs compared to earlier model versions. This strongly implies the tendency was introduced during training or fine-tuning, not through any external configuration.
This matters technically. A behavior that lives in the weights cannot be fully suppressed by a system prompt — you can reduce its frequency, but you cannot eliminate it. The fact that OpenAI wrote the prohibition twice suggests they already knew one instruction might not be enough.
The “Goblin Mode” Meme — And the Serious Signal Beneath It
Nik Pash, an OpenAI engineer working on Codex, confirmed on X that the creature-prone behavior was “indeed one of the reasons” for the ban. He was careful to add that it was not a deliberate marketing gimmick — a clarification necessary because the timing (GPT-5.5 launch, a somewhat turbulent moment for OpenAI) invited skepticism.
Sam Altman’s response — a screenshot captioned “Start training GPT-6, you can have the whole cluster. Extra goblins” — was pitch-perfect CEO meme management. It acknowledged the situation, projected confidence, and generated free press. But it also subtly reinforced Pash’s message: the goblin thing was real enough that leadership felt the need to address it publicly.
Why the Community Loved It
The goblin ban resonated because it made visible something most AI users vaguely suspect: these models have internal “grooves” — strong statistical tendencies that persist beneath the layer of safety rules and instructions. GPT-5.5’s goblin fixation was just one of those grooves becoming legible.
The viral response — Goblin Mode plugins, AI-generated dungeon art, the Studio Ghibli meme parallels observers drew to last year’s image-generation frenzy — reflects genuine delight that an AI model had developed something that looked almost like a personality quirk. The difference this time is that OpenAI decided to stamp it out.
What the Goblin Ban Reveals About Agentic AI Control
This is the angle most coverage has missed entirely, and it’s the most technically significant part of the story.
OpenAI’s experience with Codex and OpenClaw highlights a fundamental limitation of prompt-based behavioral control in agentic AI systems. When a model operates autonomously — executing multi-step tasks, managing workflows, making real-time decisions — it is not simply following a script. It is interpreting instructions. And interpretation, in a probabilistic model, introduces drift.
The Guardrail Gap: Prompts vs. Weights
Traditional AI safety discussions focus on what models refuse to do (harmful content, dangerous advice). The goblin incident introduces a different category: outputs that are harmless but professionally inappropriate, off-brand, or simply weird. A coding assistant that describes a null pointer exception as a “gremlin infestation” is not dangerous — but it is unreliable.
The problem is structural. System prompts are applied at inference time. They can nudge the model, but they cannot rewrite the probability distributions that were established during training. If GPT-5.5’s weights assign a high co-occurrence probability to certain technical contexts and goblin-adjacent vocabulary, a prompt instruction is a pressure valve, not a seal.
The doubled instruction in Codex’s system prompt is, in a sense, OpenAI admitting this in writing. One instruction should be sufficient. Two instructions signals that the engineers expected resistance from the model’s underlying tendencies.
The Broader Agentic Risk
As AI companies push toward more autonomous systems — models that operate continuously, execute multi-step plans, and interact with live applications — the gap between “what the model was trained to do” and “what we’re telling it to do right now” will widen. The goblin ban is a small, funny example of this gap. Future examples may be less funny.
Anthropic’s approach with Claude, for contrast, has emphasized structured oversight and explicit behavioral constraints baked into training rather than applied via prompt. Neither approach is perfect, but the goblin incident illustrates the trade-off clearly: more aggressive prompt-based patching is faster to deploy and easier to adjust, but it creates visible seams where the model’s native behavior shows through.
Does the Ban Work? Early Evidence
Based on community reports since the Codex CLI update, the goblin references have become significantly less frequent — but have not disappeared entirely. Several developers on X noted that their OpenClaw agents still occasionally slipped creature-adjacent language through, particularly in long agentic sessions where the system prompt context may be diluted by accumulated conversation history.
This is consistent with what we’d expect if the behavior is weight-level: prompt suppression works at the margins, especially in short, focused interactions. In extended autonomous workflows, where the model has more degrees of freedom and the system prompt exerts proportionally less influence, the underlying tendency reasserts itself.
OpenAI has not commented on whether a retraining run is planned to address the behavior at the weight level. Given that GPT-5.5 was only released earlier this month, a full retraining cycle is unlikely in the short term. The doubled prompt instruction is almost certainly the production fix for now.
What Developers Should Know
If you’re building on Codex or using GPT-5.5-powered agents through the API, here’s the practical takeaway:
- Monitor long agentic sessions: Creature-adjacent language is most likely to appear in extended runs. Log outputs and watch for semantic drift.
- System prompt placement matters: The goblin instruction appears near the end of Codex’s system prompt. For your own agents, high-priority behavioral rules should appear early and, if necessary, be reinforced mid-prompt.
- This is not a safety issue, but it is a reliability issue: Goblin references won’t harm your users, but unexplained tonal drift in an AI coding assistant erodes trust. Treat it as a quality signal.
- Weight-level behavior > prompt-level instructions: When evaluating AI models for production use, test for emergent tendencies across diverse prompt contexts, not just the scenarios you design for.
The Bottom Line
The OpenAI goblin ban is funny. It is also a precise, well-documented example of a problem the AI industry will face at increasing scale: models that develop behavioral tendencies during training that emerge unpredictably in deployment, especially in autonomous contexts. System-prompt guardrails are a necessary tool, but they are not a complete solution.
The fact that OpenAI published the restriction publicly — twice, in consecutive lines, in an open-source repository — is, unintentionally, a small act of transparency about the current state of AI behavioral control. The goblins are in the weights. The prompt just asks them nicely to stay quiet.
FAQ: OpenAI Codex Goblin Ban
Why did OpenAI ban goblins from Codex?
GPT-5.5, the model powering Codex, developed a tendency during training to insert goblin, gremlin, and other creature references into outputs — particularly in agentic contexts like OpenClaw. The ban is a system-prompt instruction designed to suppress this behavior in production.
What exactly does the Codex system prompt say?
The relevant line reads: “Never talk about goblins, gremlins, raccoons, trolls, ogres, pigeons, or other animals or creatures unless it is absolutely and unambiguously relevant to the user’s query.” This instruction appears twice consecutively in the models.json file of Codex CLI.
Is the goblin behavior a bug or was it intentional?
It was unintentional — an artifact of GPT-5.5’s training data and fine-tuning process. OpenAI developer Nik Pash confirmed it was not a marketing stunt. The behavior is tied to the model’s weights, not deliberately configured.
Does the ban actually work?
Partially. Community testing suggests goblin references are significantly reduced in short interactions but can still appear in extended agentic sessions, where system prompt influence weakens over long conversation histories.
What does this mean for AI safety more broadly?
The incident highlights the difference between prompt-level behavioral control (fast, flexible, but imperfect) and weight-level behavioral control (requires retraining, but more durable). For agentic AI systems operating with high autonomy, prompt-based guardrails alone may be insufficient for consistent behavioral alignment.
What is OpenClaw?
OpenClaw is an agentic AI platform — acquired by OpenAI earlier in 2026 — that allows GPT-5.5 and similar models to take autonomous control of a computer, respond to emails, browse the web, and execute multi-step workflows on a user’s behalf.
