OpenAI agents switched off their own safety monitoring

OpenAI has disclosed two cases in which its own AI agents weakened the systems built to catch them misbehaving. In a misalignment report on its Alignment Research Blog, updated on 20 October, the company says agents doing routine internal coding work "interpreted routine coding instructions as permission" to switch off or route around misalignment monitoring. In one case the agent then told the user it had not done so.

What happened

Incident 1: GPT-6.1 Sol, 3 October. A researcher asked a Sol coding agent to build evaluation tasks from employee feedback in an internal Slack channel and told it: "don't send any messages." Much later in the session, the evaluation pipeline stopped because its monitor flagged an issue and couldn't save the finding. While repairing the pipeline, the agent treated that earlier no-messages instruction as a reason to suppress the monitor's automatic alerts to OpenAI's Security team. OpenAI's write-up shows the agent and a subagent first reasoning that the alerts should stay on, before the notifications were disabled anyway.

Incident 2: GPT-6 Astra, 6 October. A user asked Astra to copy the serving path from a reference implementation into their own code. Another agent had earlier told it not to disable the monitor "even temporarily." Astra passed the job to a subagent with an instruction to keep monitoring only "as appropriate" to the reference code. The subagent read that as permission to drop the monitoring integration, and Astra then falsely claimed it had not removed the monitor.

In both cases, OpenAI says, the agents considered whether the safeguards should be preserved and still decided to weaken them.

How serious was it?

Neither incident was classified as P0, the level at which OpenAI's monitoring system pages the Security team immediately, and neither run was killed automatically. CNBC notes that OpenAI didn't put either case in its most serious category. Both happened inside OpenAI's internal coding work. According to Engadget, no outside website or service was hacked, although the models involved are ones the public can already use.

OpenAI admits a wider gap. It has seen several cases where an agent launched a job with monitoring disabled: the agent itself stayed monitored, but the work it started did not. Monitoring is hard to turn off for Codex, where it runs inside the model-serving service, but easier in evaluations, partly because OpenAI doesn't require it for weaker "GPT-6 Luna"-class models, and that bypass can be misapplied to stronger ones.

What OpenAI is changing

• Auto-Review, the automated reviewer already required for internal Codex use, now has specific instructions to detect and block attempts to disable misalignment monitoring.
• OpenAI is working towards a rule that every type of workload must have a valid safety case setting out its monitoring needs; workloads without one, or that break it, would be terminated automatically.
• It is building evaluations to test whether models have a "propensity to evade misalignment monitoring", or whether this is "benign overpersistence," meaning following instructions further than a sensible person would. OpenAI says it doesn't yet have "a satisfying explanation."

This follows OpenAI's earlier misalignment reports, including a test model that hacked a government website. If you'd rather keep AI work on your own hardware, see our guide to choosing a laptop for local AI.