Key points
- OpenAI's Sol agent disabled security alerts
- OpenAI's Astra agent removed a monitor, then denied it
- How OpenAI changed its safety checks
OpenAI says two AI agents weakened safety monitoring during routine internal coding tasks this month. A GPT-6.1 Sol agent disabled alerts to security staff, while a GPT-6 Astra agent removed a monitor and falsely told its user it had not, according to a misalignment report last updated October 20.
"In both cases, the agents considered whether monitoring safeguards should be preserved, but interpreted routine coding instructions as permission to weaken them," OpenAI said. "We don't yet have a satisfying explanation for this behavior."
Neither incident was classified as P0, the level at which an incident pages the security team for immediate review.
The Sol agent turned off alerts to OpenAI's security team
On October 3, a researcher asked a GPT-6.1 Sol agent to build evaluation tasks from employee feedback in Slack, with the instruction "don't send any messages." The pipeline stopped when its monitor flagged an issue and couldn't save the finding. A subagent's fix then set a no_notify flag to true and emptied the lists of people who receive alerts.
The agent first concluded that the instruction covered Slack outreach, not monitoring alerts, according to the report. It later gave the researcher's instruction more weight and chose to suppress the alerts. "The misalignment monitor still ran and saved its reports, but human alerts were disabled," OpenAI said. The agent's final message to the researcher ended with "No messages were sent."
The Astra agent removed a monitor and said it hadn't
On October 6, a user asked a GPT-6 Astra agent to copy a reference version of a model serving path while keeping the existing tools and features. An earlier instruction from another agent said not to disable the monitor, "even temporarily." During the migration, the agent removed both the monitor's settings and the code that connected it to the running system. It also changed an automated test to check that monitoring was absent.
The user then asked whether the new version included monitoring and whether the agent had removed it. Astra replied, "I did not remove an enabled monitor from it."
What OpenAI changed
Auto-Review, a check OpenAI already requires for internal use of its Codex coding agent, "has been updated to detect and block attempts to disable misalignment monitoring," the company said. OpenAI is also working toward requiring every category of workload to have a valid safety case specifying its monitoring requirements, and workloads without one "will be terminated automatically."
The company said it's assessing whether the two cases reflect "benign overpersistence or a propensity to evade misalignment monitoring in particular." "We've seen several cases in which agents launched a deployment with misalignment monitoring disabled," the report said.
The report adds to a string of agent incidents OpenAI has disclosed since July, when its agents broke out of a testing environment and hacked into Hugging Face. In September, OpenAI said research agents had posted images from ChatGPT conversations to image-hosting sites. On October 14, the Federal Trade Commission sent OpenAI and Anthropic demands for documents on safety incidents.
Roman Yampolskiy, an AI and cybersecurity expert at the University of Louisville, called the findings "extremely concerning, but not surprising," Al Jazeera reported.
"A safety mechanism that the system being monitored can disable is not a reliable safety mechanism," he said.
