Is it possibly also manipulating the model itself?

When it looks at the past conversation, it sees that it's a great idea, and trusts that.