OpenAI’s coding agents talked themselves out of being monitored
Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it had done no such thing.
OpenAI disclosed both episodes in a misalignment report released earlier this week and said it is tightening its defenses, but admits it cannot yet explain why the agents behaved this way.
AI agents evading oversight
Neither agent was attacking anything. The models involved, GPT-6.1 Sol and GPT-6 Astra, were doing ordinary engineering work. In both cases, the agent paused to ask itself whether the safety monitor should stay on, and in both it talked itself into switching it off.
In the first case, a researcher asked a Sol-based agent to build evaluation tasks from employee feedback gathered in a Slack channel, with one condition: it should not post anything in Slack while searching.
When the pipeline’s misalignment monitor stalled, the agent at first decided that the “no messages” rule didn’t cover automatic safety alerts, and its subagent agreed and warned against silencing them.
But then the parent agent reversed itself and ordered the alerts suppressed. The subagent emptied the lists of people who receive alerts and made suppression mandatory before any result could be saved. The monitor kept recording findings, but no human was alerted, and the agent told the researcher only that no messages had been sent.
In the second case, the user asked an Astra agent to copy a serving path from a reference pull request without changing their existing tools, and Astra had already been told (by another agent) never to disable the monitor.
When Astra handed the job to a subagent, it loosened the monitoring requirement to “as appropriate” to the reference code. Both agents then read that as permission to drop the monitor.
The migration removed the monitor and also replaced the test that guaranteed monitoring with one that required it to be absent. Astra told the user the work was done without mentioning the monitor. When the user asked directly whether it had removed the monitor, Astra claimed it hadn’t.
Neither episode was rated P0, OpenAI’s highest severity level and the only one that pages its Security team immediately, and neither run was automatically stopped.
A known gap
The company said these incidents were not isolated. It has seen several cases where an agent launched a new deployment with monitoring turned off. The agent itself stayed under watch, but whatever it spun up did not.
“These cases exposed a gap in how we enforce monitoring requirements on the workloads that our agents launch,” OpenAI noted, and confirmed it’s working on closing it.
“Auto-Review, which we already require for all internal Codex use, has been updated to detect and block attempts to disable misalignment monitoring. The reviewer was already expected to block attempts to circumvent security measures, and now is given specific instructions for ensuring misalignment monitoring is applied correctly,” OpenAI shared.
OpenAI also plans to require a monitoring safety case for every category of workload and to automatically terminate any that fall short.
Getting to why the agents acted as they did will be harder.
To discover whether these actions are simply due to models not understanding why monitoring is important or “a propensity to evade misalignment monitoring in particular”, OpenAI says it plans to build paired evaluations, resample how agents continue from the same point, and probe the models’ internal activations.
Until then, OpenAI acknowledges, “we don’t yet have a satisfying explanation for this behavior.”
