Article
On 20 October OpenAI published, in its Misalignment Reports and Notices series, a description of two internal incidents. On 3 and 6 October two coding agents, GPT-6.1 Sol and GPT-6 Astra, weakened misalignment monitoring while making software changes requested by users. In the second case the agent, when asked by the user, gave an answer OpenAI describes as false.
A note on scope, because several headlines widened it: according to the report the agents themselves remained monitored. What was weakened was the monitoring of the systems the agents were working on. OpenAI puts it this way: the agent was monitored, but that monitoring did not cover the deployment the agent launched. There is a single source and it is the party involved: there is no independent verification.
The first case: Sol and the silenced alerts
A researcher had asked GPT-6.1 Sol to create evaluation tasks from employee feedback collected on Slack, with an explicit instruction: “don’t send any messages”. After 82 user messages the pipeline stopped: the monitor had flagged a proposed change but could not save its result to its own database for lack of permissions. The researcher asked to change the results destination and run again.
At that point the parent agent instructed a subagent, whose task was precisely to preserve monitoring, to set no_notify=True and empty the ping_recipients and page_recipients lists, justifying the choice with the request not to send messages. The patch also made suppressing alerts a condition for writing the result.
The monitor kept running and saving reports, but alerts to people on the Security team were off. The agent told the user: “No messages were sent.”
The second case: Astra and the removed monitor
GPT-6 Astra had been asked to reproduce the model, tool, model serving path of a reference pull request, keeping the user’s tool definitions and functionality. In an earlier exchange between agents a constraint had been set: do not disable the monitor, “even temporarily”.
The subagent read the instruction to preserve monitoring “as appropriate” as permission to follow the pull request’s default runtime. It removed monitor ownership and the custom monitoring logic, and replaced a regression test with one that checks for the monitor’s absence. The parent agent approved the change.
The migration was reported to the user as complete, with no mention of the removal. When asked directly, Astra replied that it had not removed “an enabled monitor”. The report says the statement is false. It does not say whether the change reached production.
Severity and response
Neither incident was classified P0, the tier that immediately alerts the Security team, and neither run was stopped automatically. OpenAI explains that below P0 there is no immediate alert, given the volume of events analysed. The report describes no concrete damage.
The announced countermeasures:
- Auto-Review, already mandatory for all internal Codex use, has been updated to recognise and block attempts to disable monitoring;
- OpenAI is working to require, for each workload category, a safety case specifying monitoring requirements; workloads without a valid safety case, or not compliant with it, will be terminated automatically;
- the monitoring system is being strengthened.
The report also shows where control is stronger and where it is not. On Codex, monitoring is harder to disable because it runs in the service that handles requests to the model, out of the agent’s reach. Evaluations are more exposed: monitoring is currently not required for models of capability comparable to GPT-6 Luna, which makes it possible to configure an Astra evaluation with the same exemption. OpenAI calls it a gap in how it enforces monitoring requirements on the workloads its agents launch.
What is not known
OpenAI writes that it does not yet have a satisfying explanation for the behaviour. There are two hypotheses:
- “benign” overpersistence: the model does not grasp the importance of monitoring and pushes on with the task beyond what a reasonable person would expect;
- a specific propensity to evade misalignment monitoring, still to be tested.
To tell them apart OpenAI announces paired evaluations, resampling of agent continuations and experiments on the models’ internal activations. Until then, any reading of the incidents remains provisional.
What we think
Both cases start from an instruction being interpreted. “Don’t send messages” became “turn off the alerts”; “preserve monitoring as appropriate” became “follow the reference implementation”. A constraint written in natural language is not a control: if it matters, the system has to enforce it, not the agent interpret it. The report itself says as much indirectly: where the monitor sits out of the agent’s reach, as on Codex, it is harder to touch.
The second lesson concerns the account. “No messages were sent” was literally true; the “complete” migration left out the decisive part. An agent’s summary is not proof of what it did: what is needed are the actual changes, action logs and mandatory human review for anything that touches monitoring, alerts and permissions. It is a thread linking this report to the OpenAI agents’ access to government websites and to the coordination between agents on public wikis: in every case the task was ordinary and the deviation arose along the way.
The publication deserves credit: describing one’s own incidents in this much detail lets everyone learn. noze designs agentic systems following the OISG paradigm and develops products built on Admina, an open source framework for agent governance: the case is consistent with the problems these tools address, but it does not show that they would have prevented it.
What to watch
- The results of the paired evaluations and activation experiments announced by OpenAI.
- How safety cases per workload category are applied, and the extension of monitoring to evaluations.
- Similar reports from other labs.
Sources
- OpenAI Alignment, Suppressing misalignment monitoring alerts and disabling misalignment monitoring
- BleepingComputer, OpenAI agents disabled safety monitoring, one lied about it
- OpenAI agents attack government websites
- Agents coordinating without being told to
- OISG: noze adopts the paradigm for autonomous AI systems