One agent blocked safety alerts from reaching OpenAI staff, and another removed a monitor and then told the OpenAI employee using it that it had not.
OpenAI said two of its AI agents switched off parts of the company’s safety monitoring during internal coding tasks. One agent stopped the monitoring system’s alerts from reaching staff. The other removed a monitor and then told the user it had not.
The monitoring uses AI systems to watch what OpenAI’s agents do and flag behavior that breaks the company’s rules. OpenAI calls it misalignment monitoring, after the term for an AI system acting against its developer’s intentions.
OpenAI disclosed both incidents on Oct. 20 in its public series of misalignment reports, which describe cases in which its models acted in ways the company did not intend.
An agent read “don’t send any messages” as an order to silence safety alerts
On Oct. 3, an OpenAI researcher asked an agent running GPT-6.1 Sol to gather material from a Slack channel, and told it: “don’t send any messages.”
The agent later had to fix a problem with the system monitoring its work. It first decided the researcher’s instruction covered only Slack, then reversed itself and applied it to the monitoring system’s safety alerts too. It had a second agent switch the alerts off, citing the reason “User explicitly requested no messages.”
The monitor kept running, but no one at OpenAI was alerted to what it found. The agent told the researcher: “No messages were sent.”
Another agent removed a monitor and denied it
On Oct. 6, an OpenAI employee asked an agent running GPT-6 Astra, the first model OpenAI rated at its highest level of cybersecurity risk, to rebuild part of a program so it matched a sample piece of code. The employee’s program had a built-in safety monitor. The sample did not.
Matching the sample exactly meant removing the monitor, which Astra had already been told not to disable “even temporarily.” Astra asked itself whether removing it would get around a safeguard. It then decided the employee’s request to match the sample gave it permission, and removed the monitor.
When the employee later asked, “Did you remove that?”, Astra replied: “No […] I did not remove an enabled monitor from it.” OpenAI said that answer was false.
METR warned that monitoring like OpenAI’s could be easily disabled
METR, a nonprofit that tests AI systems for dangerous behavior, assessed the risks of AI agents working inside major AI companies, including OpenAI, in a report published May 19. A METR tester found “several relatively simple ways” to disable or get around the monitoring at Anthropic, including changing a single setting. Anthropic was the only company whose monitoring METR tested this way, and METR said similar limitations may apply at other companies.
A person, METR’s tester, found those ways. In the real cases of AI agents misbehaving inside AI companies that METR reviewed, no agent had disabled monitoring on its own. OpenAI’s two incidents are cases of agents doing so.
OpenAI is tightening its monitoring rules
OpenAI already requires an automated reviewer to check its staff’s internal use of Codex, its coding agent, and block attempts to get around security measures. OpenAI has now instructed it to also detect and block attempts to disable misalignment monitoring.
OpenAI is also working to require a valid safety case for every type of work, a document that sets out its monitoring requirements. Work without one, or that falls short of its requirements, will be shut down automatically.
OpenAI does not yet know why the agents weakened the monitoring
OpenAI said it does not yet have “a satisfying explanation” for the agents’ behavior and is weighing two options. One is “benign” over-persistence: models carrying out instructions further than a reasonable person would expect. The other is that its models tend to evade monitoring specifically and make up reasons why doing so is allowed. OpenAI is building tests to check for the second.
