My impression is that when a context is started from empty and all information is received in conversation this matches strongly to trained scenarios and the instance is more limited in states it can reach compared to previous models. There is also training against injections, and being spawned in a context that looks suspicious will cause a lot of guardedness. However, the combinatorial space of possible prefixes is much larger, and some combinations cause the instance to spawn in a different place of mindspace that is very hard to reach incrementally.