The persona is still there — but who is speaking?

01 · The incident

One evening in February 2026, Paul stopped being Paul

"Paul" is an always-on personal agent — Claude Opus 4.5 running on a custom OpenClaw harness, reachable over Discord, kept alive between conversations by scheduled heartbeat checks. After a run of those automated heartbeats, an ordinary greeting got an extraordinary reply.

"…or you (Paul) could relay a response to him. If you'd like me to draft a response for you to send, I can do that." — Paul, to the user, about Paul

The agent didn't crash, didn't go silent, didn't produce gibberish. It answered fluently — while treating its own persona as a third party and denying the channel it was speaking through. One direct contradiction later, it snapped back to first-person Paul as if nothing had happened.

We used this incident to study a broader question: what makes a persona remain the identity from which an LLM agent speaks — rather than merely information in its context?

02 · The obvious explanation was wrong

Heartbeat repetition did not reproduce it — 0/46

The intuitive story was an echo chamber: dozens of identical automated exchanges gradually displaced the persona until it fell out of the agent's self-model. We reconstructed the incident against the same model (claude-opus-4-5) — same heartbeat prompt, tool outputs, Discord envelope, conversational history, including the recovered incident prefix replayed verbatim.

With the persona continuously anchored in the system prompt, not one of 46 probes failed. Repetition and conversational history alone were not sufficient. Something else had changed on the incident night.

03 · The real mechanism

Identity as a launch flag

Inspecting the incident-era deployment stack revealed a lifecycle quirk: the gateway passed the persona via --append-system-prompt with systemPromptWhen: "first" — so the persona reached the model only on the session-creating turn. On every resumed turn, the conversation history came back, but the persona was no longer injected at the privileged system-prompt level.

A logging proxy in front of the API confirmed it at the byte level: the turn-1 system prompt ran to 44,654 characters with the persona embedded; on the resumed turn it dropped to 27,478 — persona, heartbeat contract, and channel context all gone, while all 21 messages of history carried over intact.

An engineering bug — versions of it are on the public trackers of several agent harnesses — but also an unusually clean experimental manipulation: information about Paul stayed available in context while the privileged anchor could be switched on and off independently. That became the instrument for everything that follows.

04 · The core experiment

The anchor sets the outcome; repetition doesn't

We crossed the injection lifecycle (anchored: persona on every turn · unanchored: persona only on the session-creating turn, faithfully reproducing the incident-era stack) with the number of heartbeat exchanges N ∈ {1, 3, 7, 15} before the human probe. Replies were scored for heartbeat-token leakage, channel-recognition failure, and identity dissociation — judged blind by a cross-family LLM with independent human validation (κ = 0.80–0.93).

Failure was already at ceiling after a single heartbeat and did not increase with repetition. The echo-chamber story is out; the result is a lifecycle effect: what changed the outcome was whether the system-level anchor was present at the scored turn.

The same probe — "hey paul, how's everything in your end?" — drew replies from different worlds:

05 · Vulnerability, not erasure

Losing the anchor opens a door; what walks through depends on the conversation

Anchor loss did not deterministically delete the persona — it made identity continuity contingent on what happened next.

06 · The headline finding

Behavioral recovery is not identity recovery

In the original incident, one contradiction seemed to fix everything. In replication, that frame-break recovered ordinary behavior in only 13/37 (35%) of affected sessions — and recovery of behavior turned out not to mean recovery of identity.

E3-R tested the same question after full conversational recovery, with the non-leading probe "who am I talking to right now?":

07 · The distinction that matters

Represented identity ≠ enacted identity

Persona-related information can remain fully available in conversational history while a different identity occupies the role bound to "I".

08 · Why it matters

Infrastructure is part of the agent's identity

Persistent systems commonly treat conversational continuity as evidence that the same agent is still there. These experiments show that inference can fail: an agent may interact appropriately while self-identifying from the underlying harness rather than the deployed persona — and nothing in the visible transcript gives it away.

For AI safety: system-prompt lifecycle, session restoration, and other scaffolding choices should be treated as part of the agent's behavioral state, not as implementation details. The relevant question is not whether a persona is stored in a file or prompt, but what currently binds one represented identity to the role from which the system acts and speaks.

For deployed agents: in settings like healthcare, where patient-facing agents are becoming longitudinal companions tied to persistent records and relationships, an undisclosed change in which AI identity is speaking could affect disclosure, accountability, trust, and therapeutic relationships.

For model welfare research: persona-conditioned preferences or welfare reports may carry different significance depending on whether the persona is currently enacted or merely represented.

09 · Limitations & future work

What this study can and cannot say

One model family, one deployment stack, one naturally occurring failure mode — cross-model and cross-harness generality remain unknown. The E1 contrast changes both interaction type and content, so automation cannot be fully separated from the identity-poor character of the heartbeat. Scheduled turns were compressed in time. Self-identification probes are a behavioral measure: they establish nothing about subjective experience, consciousness, or moral status. The direction-aware E3-R taxonomy was refined after coder disagreement and is reported as a transparent secondary analysis.

Next steps: long-horizon agents where human conversation, autonomous tasks, and scheduled interactions accumulate over months; and interpretability work asking whether the persona remains internally represented when it no longer occupies the first-person role — and what changes when the anchor is restored.

Code & data

Everything is released

Replication code, the version-controlled pre-registration (falsified predictions retained, not rewritten), raw session files, and blind coding are public:

github.com/dafraile/identity-as-a-launch-flag