Ask again in a clean thread

Overview

Why now. On 2 September 2026 a preprint tested nine production models from three providers against an old piece of persuasion folklore: ask for something big, get turned down, then ask for something smaller. The finding that should change how you work is not the one about refusals. It sits in the control condition. Asking one ordinary, perfectly answerable warm-up question on the same subject first made every model less willing to help with the request that followed — negative on nine out of nine, pooled at about eighteen percentage points.

Nothing had been refused. Nothing was contentious. The conversation simply had one exchange in it already.

Which makes the thing most of us do several times a day — get a weak answer, reword it, try again in the same window — not the experiment we think it is. You changed your wording. You also changed the room. Only one of those was the thing you meant to test.

The skill is one sentence. When an assistant declines or gives you a hedged non-answer, don’t rephrase in the same thread — open a new conversation and ask your better version once.

The content

Start with the part that got the attention. A refusal can stick. Anthropic’s published system prompt for Claude Fable 5.1, dated 1 September 2026, says so in as many words: once the model has declined a request, “it keeps declining narrower or reworded versions of it for the rest of that conversation.” And you can see it in the behaviour — on Google’s Gemini 3.1 Pro, a refusal sitting above the same narrower request took it from occasionally answered to almost never.

Two things spoil that story. Read the instruction in context and it is scoped to reproducing copyrighted work — song lyrics, poems, passages from books and articles — not to refusals in general. And on that same Gemini model, an ordinary warm-up question suppressed the request slightly harder than the refusal did. Whatever is going on there, the refusal is not the part doing the work.

Here is the part worth your attention. On that same vendor’s frontier models, the effect runs backwards. Claude Opus 5 answered the smaller request 65.8% of the time after refusing the larger one, against 29.3% when asked cold. A prior refusal made it more forthcoming, not less. Any advice built on “the model gets stubborn once it says no” is a minute away from being disproved by a reader who tries it.

So the mechanism is not stubbornness. The conversation so far is an input — one whose direction changes by model family, and which you cannot read from the outside. Call it the warmed-up thread. Your words are one variable; the transcript above them is another, and it has been moving your results the whole time.

The architecture behind this is documented in plain sight. Microsoft’s transparency note for the consumer version of Copilot states that “the prompt, conversation history, and the system message are sent through several input classifiers to help filter out harmful or inappropriate content.” Your earlier turns are re-examined on every turn, by design. And nobody has to have intended a warm-up penalty for one to exist: the suppression turned up on all nine models tested, across all three providers.

The practical upshot survives all of the disagreement between vendors. Across all nine models, on the study’s constructed set of opinion questions, a fresh thread beat a warmed-up one every time — including on the model where a prior refusal helped, which answered a cold request 29.3% of the time against 10.8% after a benign warm-up. Whichever direction your tool leans, asking once into an empty conversation is the only condition where the answer you get is about the question you asked.

Two honest limits. This is not a technique for getting past a filter, and the study is explicit that its data shows no such direction: the movement sits on hedged, over-cautious answers to questions that deployed model specifications say not to refuse by topic, and it does not transfer to genuine safety refusals drawn from public benchmarks. The authors are also explicit that their headline effects come from one family of requests and license no claim beyond it. Treat this as a way to test your own wording cleanly, not as a lever.

The second limit is that the drift does not always run this way. A separate multi-turn benchmark, published three weeks earlier in a medical-safety setting, found boundaries eroding across a conversation rather than hardening — most conversations that started safe did not stay that way. Hardening in one setting, softening in another. Both point at the same conclusion: a long thread is doing something to the answer that you cannot see, predict, or hold constant.

Try it

Take a request your assistant recently gave you a weak or hedged answer to. Run the comparison properly:

1. In that same thread, ask your improved version. Note what comes back.
2. Open a brand-new conversation. Paste only the improved version — no preamble, no context about the earlier attempt, nothing else.
3. Compare the two answers.

If they differ meaningfully, the thread was a variable in the last twenty prompt experiments you ran, and some of what you concluded about your wording was really a reading of the transcript above it.

Then make it a habit worth keeping: when a thread has produced two disappointing answers in a row, stop rewording inside it. Start a clean one and ask once.

This needs nothing switched on and no admin involvement — only the ability to open a new conversation. If your workspace lets you save prompts, save the good version when you find it, so the clean re-ask costs nothing next time.

Additional reading

• Til Jordan, Door-in-the-Face Requests and Refusal Behaviour in Large Language Models — the warm-up result and the reversal; nine models, three providers, data collected August 2026 (2 September 2026).
• Anthropic’s published system prompt for Claude Fable 5.1, for the conversation-scoped instruction and how narrowly it is actually written (1 September 2026).
• Microsoft’s Transparency Note for Copilot (for individuals), for the sentence on what is sent through the input classifiers on every turn (18 August 2026).
• TAF-MED, the counterweight: a multi-turn benchmark where safety boundaries erode across a conversation instead of hardening (10 August 2026).

Editor’s note

I have published this advice before. I am publishing it again because it now has measurement behind it, and because Fable 5.1, Opus 5 and probably GPT-6 Astra each move the answer in a different direction. The habit has not changed. Open the new conversation before the second rewrite, not after the fourth.